chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates - #2227
Open
dependabot[bot] wants to merge 240 commits into
Open
chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates#2227dependabot[bot] wants to merge 240 commits into
dependabot[bot] wants to merge 240 commits into
Conversation
When failing to connect to an MCP server, its very hard to understand why. There is only an opaque "Connection Error" message with no additional info. This also doesn't change at all on repeated attempts, so there is no indication we attempted again and failed. This change introduces a `toast` to visualize the error, and adds the `cause` into the error message for further debugging
Guard against calling controller.close() when the stream has already been closed by an external cancellation. This can happen when the SDK cancels the stream before the underlying Node stream emits its 'end' event. - Add `closed` flag to track controller state - Guard all controller operations with closed check - Add `cancel()` callback to handle external cancellation - Properly destroy the Node stream on cancellation
zod4 compatibility fixed for CI
1. createWebReadableStream: Add closed flag and cancel() callback to prevent double-close crashes when SSE streams end. This fixes the "Controller is already closed" error that occurs when the SDK calls response.body.cancel() on 202 responses. 2. DELETE handler: Call serverTransport.close() after terminateSession() to properly cleanup the transport and cancel pending reconnections. - terminateSession() notifies the server (sends DELETE request) - close() cleans up client-side resources (abort controller, timeouts) - Both are needed for a complete disconnect
…eam-double-close Fix ReadableStream controller double-close crash
…-debug fix: proper stream cleanup and transport close on disconnect
mcp: add icon + website for testing SEP-973
In DynamicJsonForm.tsx,
- Support all five enum shapes used by MCP SDK:
- Titled single-select via `oneOf`/`anyOf` with `{ const, title }`
- Untitled single-select via `enum`
- Titled legacy single-select with optional `enumNames` for labels
- Titled multi-select via `items.anyOf`/`oneOf`
- Untitled multi-select via `items.enum`
- Show field descriptions for string select fields and boolean checkboxes (consistent help text above inputs).
- Prefer schema property `title` for object field labels; fall back to the JSON key when missing.
- Allow top‑level form rendering for objects with properties, arrays with items, and primitive types (was overly strict before).
- Multi-select UI: sensible list size and `minItems`/`maxItems` helper text when present.
- JSON editor fallback, copy/format controls, and debounced parsing preserved.
- apply defaults for optional fields during form init
In schemaUtils.ts
- `generateDefaultValue` now includes optional properties that declare a `default`, ensuring fields like strings show their defaults on first render.
In jsonUtils.ts
- Add legacy `enumNames?: string[]` and array constraints `minItems?`/`maxItems?`.
- Align tests with new form-first rendering and UI behavior:
- Labels prefer schema `title` over property key.
- Descriptions shown for boolean checkboxes and select fields.
- Explicit mode switching between Form/JSON when needed.
- Add comprehensive coverage for enum schema variants:
- Titled single-select via `oneOf`/`anyOf` with `{ const, title }`.
- Untitled single-select via `enum` (with legacy `enumNames` labels).
- Untitled multi-select via `items.enum` with `minItems`/`maxItems` helper text.
- Titled multi-select via `items.anyOf`/`oneOf` with `{ const, title }`.
- Adjust complex/JSON-mode tests to click “Switch to JSON” before asserting textarea and clipboard interactions.
- Fix debounced JSON update expectations to assert parsed objects rather than raw text.
Files updated:
- `client/src/components/__tests__/DynamicJsonForm.test.tsx`
- `client/src/components/__tests__/DynamicJsonForm.array.test.tsx`
Bump version to 0.17.5
chore: replace main's tree with v2
CodeQL alert #64 (`actions/missing-workflow-permissions`, medium) on `.github/workflows/main.yml`: no `permissions` block, so every job inherits the repository's default GITHUB_TOKEN scope, which is broader than anything here needs. It matters more than the severity suggests because this is the workflow that publishes to npm under OIDC — an over-permissioned token in a job that mints publish credentials is worth tightening before 2.0.0 ships (#1818). Adds a workflow-level `permissions: contents: read`. The `publish` and `publish-github-container-registry` jobs already declare their own blocks (`id-token: write` and friends) and are unaffected: job-level permissions override the workflow-level default outright rather than merging with it. The comment records that, since it means each publish job must keep listing every scope it needs — including `contents: read` — and a future edit that trims one "because it's inherited" would break the publish. Surfaced by the v2 tree swap (#1817): `main` had never scanned this workflow before. Pre-existing on `v2/main`, not introduced by that merge. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* ci: set a least-privilege default GITHUB_TOKEN scope CodeQL alert #64 (`actions/missing-workflow-permissions`, medium) on `.github/workflows/main.yml`: no `permissions` block, so every job inherits the repository's default GITHUB_TOKEN scope, which is broader than anything here needs. It matters more than the severity suggests because this is the workflow that publishes to npm under OIDC — an over-permissioned token in a job that mints publish credentials is worth tightening before 2.0.0 ships (#1818). Adds a workflow-level `permissions: contents: read`. The `publish` and `publish-github-container-registry` jobs already declare their own blocks (`id-token: write` and friends) and are unaffected: job-level permissions override the workflow-level default outright rather than merging with it. The comment records that, since it means each publish job must keep listing every scope it needs — including `contents: read` — and a future edit that trims one "because it's inherited" would break the publish. Surfaced by the v2 tree swap (#1817): `main` had never scanned this workflow before. Pre-existing on `v2/main`, not introduced by that merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD * chore(deps): upgrade @hono/node-server to 2.0.12 Clears GHSA-frvp-7c67-39w9 (2 Dependabot alerts): path traversal in `serve-static` on Windows via an encoded backslash, affecting < 2.0.5. The Inspector's prod web server calls the flagged function directly (`clients/web/server/server.ts` mounts `serveStatic` at `/*`). Worth being precise about the actual exposure, since the summary line reads worse than the flaw is: `..` escapes remain blocked, so it only reaches files *inside* the configured root, by slipping past prefix-mounted middleware. Here `root` is the built SPA — everything in it is public by design — and the only prefix middleware (`/api/*`) is a separate route, not a subdirectory of that root. So there was no auth bypass and no arbitrary file read to fix; this is hygiene, not an incident. The 1.x → 2.x majors turn out to be a non-event for this codebase: v2 drops Node 18 (the repo already requires >=22.19.0) and removes the Vercel adapter (unused). `serve`, `serveStatic`, and `ServerType` — the entire import surface here, across the prod server and ~15 integration tests — are unchanged. `npm run validate` passes on all four clients. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
… latest (#1834) `npm publish` defaults to `--tag latest` regardless of semver prerelease status, and the publish step passed no `--tag`. So cutting the `2.0.0-rc.1` release that #1818 calls for would have published the release candidate to `latest` — pointing every `npx @modelcontextprotocol/inspector` at an RC. That is the same class of failure #1816 fixed for v1, except triggered deliberately by following the runbook. Derives the tag from the version: a hyphen after the patch component means a prerelease (`2.0.0-rc.1` → `next`), anything else is a release (`2.0.0` → `latest`). Build metadata (`2.0.0+build.5`) is correctly not a prerelease. Implemented as a shell `case` rather than with `semver`, which is only a transitive dependency here and should not be relied on in CI. Also makes the RC step of #1818 possible at all — there was previously no way to pass a dist-tag through a release-triggered publish. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Release candidate for the 2.0.0 go-live (#1818, §6). Publishes under the `next` dist-tag via the derivation added in #1834 — verified: `2.0.0-rc.1` contains a hyphen after the patch component, so it resolves to `next`, leaving `latest` on 1.0.1 untouched. The RC exists to exercise what only exists against the live registry: the `next`-tag publish path itself (newly written in #1834), provenance/OIDC minting, the `files` allowlist as npm actually packs it, and the postinstall cascade's early-exit under a real dependency install on a clean machine. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…TOKEN (#1836) * fix(ci): publish via OIDC trusted publishing, not a non-existent NPM_TOKEN The 2.0.0-rc.1 publish failed with `npm error code ENEEDAUTH`. Two causes, both in the v2 publish job, which had never actually executed before — every prior release was cut from the v1 workflow. 1. `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` pointed at a secret that does not exist (the repo has no secrets at repo or environment level — publishing moved to OIDC trusted publishing). `setup-node` therefore wrote an *empty* `_authToken` into its generated `.npmrc`, and npm failed ENEEDAUTH before OIDC was ever attempted. Removed, with a comment saying why it must not be "restored". 2. The job never upgraded the npm CLI. Trusted publishing requires npm >= 11.5.1 and Node 22 bundles 10.x, so this would have failed even with the token line gone. The v1 workflow has this step; v2 was missing it. The RC did its job: it caught both against the real registry, and consumed nothing — the run failed before `npm publish` wrote anything, so no version was burned and the dist-tags are untouched. Also confirms #1834 works: the log shows `Publishing 2.0.0-rc.1 under dist-tag 'next'` before the auth failure. README corrected — it documented `NPM_TOKEN` as part of the publish setup. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD * docs: restructure the test-servers section into navigable subsections The section had grown into eight undifferentiated paragraphs, the longest 1,965 characters, each describing one or two showcase configs. The content is good reference material — the problem was purely that you could not find anything in it or tell where one config's description ended and the next began. Restructured, not rewritten. No facts removed: - A summary table of all nine showcase configs, with what each demonstrates and its tracking issue, so the set is visible at a glance. - One `####` subsection per config family, so each is linkable and skimmable. - Enumerations that were buried in prose are now tables: the six MRTR presets, the four `trigger_*` spec-error tools and their status/code pairs. - Step sequences (advertised extensions) and era contrasts (logging, subscriptions, tasks) are now bullets rather than run-on sentences. - Two caveats that were parenthetical asides — browser `Mcp-Param-*` skipping, and `collect_elicitation` erroring on the modern leg — are now blockquotes, since both are things you hit and then have to go hunting for. Longest line drops 1,965 → 620 characters. Verified every previously-documented config and all technical identifiers survive. Noted while auditing: `demo.json`, `oauth-step-up-demo.json`, `url-elicitation-form.json` and `xaa-ema-http.json` exist in `test-servers/configs/` but have never been documented here. Left alone — that is a pre-existing gap, not a regression from this change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sweeps every Dependabot alert that reaches users, then bumps to rc.2 so the swept tree gets the same live-registry validation rc.1 got. Deliberate: rc.1 validated a specific dependency tree, and changing it invalidates that proof. Result: **zero prod-scope high/critical vulnerabilities** across all five manifests (root + four clients). Achieved with lockfile changes ONLY — no package.json touched, no declared range widened, no major upgrade. Every one of these was a stale lockfile pin sitting inside an existing caret range: hono → 4.12.32 (needed 4.12.27) fast-uri → 3.1.4 (needed 3.1.3) postcss → 8.5.23 (needed 8.5.18) brace-expansion → 1.1.16 (needed 1.1.16) js-yaml → 4.3.0 (needed 4.3.0) ws → 8.21.0/1 (needed 8.21.0) flatted → 3.4.3 (needed 3.4.2) Two dev-scope clusters remain, both deliberately untouched — neither ships (the `files` allowlist is `clients/*/build`, `clients/web/dist`, and `scripts/install-clients.mjs`), and both need real work that does not belong immediately before a release: - eslint (5 alerts × 5 lockfiles): a `brace-expansion` DoS via `minimatch`, fixable only by eslint@10 — a major bump across every package, likely requiring rule migration. The glob patterns involved come from the repo's own config, never attacker-controlled. - vitest (3 critical, clients/web): a circular exact-pin knot — `@vitest/browser-playwright@4.1.0` requires `@vitest/browser@"4.1.0"` exactly, `vitest@4.1.0` requires `@vitest/browser-playwright@"4.1.0"` exactly, and `@storybook/addon-vitest` constrains the set further. `npm i` fails ERESOLVE; untangling means moving Storybook too. `npm run ci` passes on the swept tree — full chain including the coverage gate, build gate, smokes, and 462 Storybook tests. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…visories; 2.0.0-rc.3 (#1841) The #1837 sweep moved vite to 8.0.16 in the root and tui manifests but left `clients/web` pinned at **8.0.0** — `npm update` reported "up to date" and only an explicit install would move it. That left five open advisories, three high: GHSA-fx2h-pf6j-xcff high `server.fs.deny` bypass via Windows ADS GHSA-v2wj-q39q-566r high `server.fs.deny` bypassed with queries GHSA-p9ff-h696-f583 high arbitrary file read via the dev server GHSA-v6wh-96g9-6wx3 medium launch-editor NTLMv2 hash disclosure GHSA-4w7w-66w2-5vf9 medium path traversal in optimized deps These are worth fixing rather than dismissing as "dev-only". Unlike the other remaining dev-scope alerts, `server.fs.deny` bypass is *remotely triggerable*: a malicious page can read arbitrary files from anyone running `npm run dev`. Published-package users are unaffected — they get the built `dist` and never run vite — but contributors are. Also raises the declared floor to `^8.1.5` in all three manifests that declare vite. The root previously declared `^8.0.0`, which still *permitted* the vulnerable 8.0.0 on a fresh resolve, so pinning the lockfile alone would have left a regression path open. Bumped to rc.3 rather than folding this into 2.0.0: vite builds the shipped bundle, so changing it changes the artifact, and the tree that ships should be the tree that was validated against the live registry. rc.2 validated a different tree. `npm run ci` passes — full chain including the coverage gate, build gate, smokes, and 462 Storybook tests. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The v2 go-live release (#1818, phase 5 of #1804). This is byte-identical to 2.0.0-rc.3 apart from dropping the prerelease suffix, which is what makes rc.3's validation meaningful: the tree that ships is the tree that was validated against the live registry. `2.0.0` has no hyphen, so the derivation added in #1834 resolves it to `latest` — this is the release that takes the tag from 1.0.1. Validated across three release candidates: - rc.1 caught two publish-path defects invisible to every local check — `NODE_AUTH_TOKEN` pointing at a non-existent secret (shadowing OIDC trusted publishing) and a missing npm CLI upgrade (trusted publishing needs >= 11.5.1; Node 22 bundles 10.x). Both fixed in #1836. - rc.2 validated the dependency sweep (#1837) that cleared every prod-scope advisory using lockfile-only changes. - rc.3 validated the vite 8.1.5 bump (#1841) closing three high-severity dev-server file-read advisories. Each RC was verified with a cold `node:22` container install driving the published tarball end to end — install, `--help`, and a real `--cli tools/list` against a live stdio server. `latest` remained on 1.0.1 throughout, proving the `--tag` derivation. Zero open Dependabot alerts at time of release. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
`SECURITY.md` existed on the pre-swap `main` (ac3c1a1) and still exists on `v1/main`, but the v2 tree never had one — so #1817 silently removed the security policy from the default branch. That is the wrong file to be missing right now: it is where private vulnerability reporting is advertised, and it disappeared in the same window as 2.0.0 shipping and external pull requests being turned off (#1820). Losing the PR path and the security-report path together would leave an outside reporter with no documented route at all. Restored from `v1/main` with the additions #1820 asks for: - A supported-versions table covering all four package names — v2 supported, the v1 line security-fixes-only under the `v1-latest` dist-tag, anything below 1.0.0 unsupported. The three sub-packages are named explicitly since they exist only on v1 and are deprecated. - A note that the repository does not accept outside pull requests, but that this explicitly does NOT apply to security reports, which must go through the advisory process rather than any public channel. Without that, the new issues-only policy reads as "no way to reach us". - "Whether it affects v2, v1, or both" added to the report checklist, now that two lines are live. Verified private vulnerability reporting is enabled on the repo, so the advisory link is a working route rather than an aspiration. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Resolves the eight conflicts from the first v2/main -> main milestone merge on a branch cut from main, so v2/main's ancestry stays clean -- resolving them on the PR head would have back-merged main into v2/main, which is exactly what #1868 was closed to avoid. All eight took v2/main's side, each verifiably the newer content: - README.md stale Mcp-Param-* callout; v2/main's is corrected by #1847 (the Inspector builds the headers itself) - SECURITY.md add/add (#1843 on main, #1867 on v2/main); differ by one line, the CONTRIBUTORS.md -> CONTRIBUTING.md rename from #1884 - clients/web/package.json vitest ^4.1.0 -> ^4.1.10, the #1899 fix - the five package-lock.json files, then regenerated from a clean install rather than hand-merged main's release-workflow commits (#1831 least-privilege token, #1834 dist-tag derivation, #1836 OIDC trusted publishing) auto-merged and are preserved -- .github/workflows/main.yml is the only file where the merged tree differs from v2/main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
Bumps the root package.json (and its lockfile entries) 2.0.0 -> 2.1.0 for the v2.1.0 milestone release. Only the ROOT manifest carries a version -- the four clients/* packages deliberately have none, since the Inspector ships as one tarball with a single version number that every Node client resolves through readInspectorVersion() in core/node/version.ts. So this is the only file that needs changing. Done with `npm version 2.1.0 --no-git-tag-version`: the tag is NOT created here. #1903 merges as a merge commit, so this commit lands on main intact and the release tag is pushed against it after the merge. Creating the tag now would point it at a commit that is not yet on the release branch. The publish job asserts the release tag matches this version. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
…-merge-v2.1.0 chore: merge v2/main for the v2.1.0 milestone release
Second v2/main -> main milestone merge: 27 merged PRs since 2.1.0. Clean merge, zero conflicts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3 Signed-off-by: cliffhall <cliff@futurescale.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3 Signed-off-by: cliffhall <cliff@futurescale.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3
…-merge-v2.2.0 chore: merge v2/main for the v2.2.0 milestone release
…updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.1` | | [undici](https://github.com/nodejs/undici) | `8.5.0` | `8.9.0` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.5` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.5.0` | Bumps the npm_and_yarn group with 2 updates in the /clients/cli directory: [undici](https://github.com/nodejs/undici) and [fast-uri](https://github.com/fastify/fast-uri). Bumps the npm_and_yarn group with 1 update in the /clients/tui directory: [fast-uri](https://github.com/fastify/fast-uri). Bumps the npm_and_yarn group with 1 update in the /clients/web directory: [hono](https://github.com/honojs/hono). Updates `hono` from 4.12.25 to 4.13.1 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.13.1) Updates `undici` from 8.5.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.9.0) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `fast-uri` from 3.1.0 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `ip-address` from 10.1.0 to 10.5.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.5.0) Updates `qs` from 6.15.1 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.3) Updates `undici` from 8.5.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.9.0) Updates `fast-uri` from 3.1.0 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.0 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `hono` from 4.12.25 to 4.13.1 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.13.1) Updates `fast-uri` from 3.1.0 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `undici` from 8.5.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.9.0) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `undici` from 8.5.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.9.0) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.5) Updates `hono` from 4.12.33 to 4.13.1 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.13.1) Updates `hono` from 4.12.33 to 4.13.1 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.13.1) --- updated-dependencies: - dependency-name: hono dependency-version: 4.13.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…_yarn/npm_and_yarn-2f9c272516 chore(deps): Bump the npm_and_yarn group across 4 directories with 6 updates
…-merge-v2.3.0 Signed-off-by: cliffhall <cliff@futurescale.com> # Conflicts: # package-lock.json # package.json
…-merge-v2.3.0 chore: merge v2/main for the v2.3.0 milestone release
…-merge-v2.4.0 chore: merge v2/main for the v2.4.0 milestone release
The fifth v2/main -> main milestone merge, cutting 2.5.0: 33 merged PRs and 213 non-merge commits, including the 2.4.0 -> 2.5.0 version bump (#2213), which landed on v2/main first per the #2010 procedure. Zero conflicted paths, and the merged tree is byte-identical to origin/v2/main. References #2214 Signed-off-by: Cliff Hall <cliff@futurescale.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017bussXiM47PBttWqFUkPN1 Signed-off-by: cliffhall <cliff@futurescale.com>
…-merge-v2.5.0 chore: merge v2/main for the v2.5.0 milestone release
…updates Bumps the npm_and_yarn group with 2 updates in the / directory: [fast-uri](https://github.com/fastify/fast-uri) and [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 1 update in the /clients/tui directory: [browserslist](https://github.com/browserslist/browserslist). Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.3...v6.16.0) Updates `browserslist` from 4.28.2 to 4.28.8 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.2...4.28.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 2 updates in the / directory: fast-uri and qs.
Bumps the npm_and_yarn group with 1 update in the /clients/tui directory: browserslist.
Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
qsfrom 6.15.3 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
browserslistfrom 4.28.2 to 4.28.8Release notes
Sourced from browserslist's releases.
Changelog
Sourced from browserslist's changelog.
Commits
f2f2e6cRelease 4.28.8 versiond0787c8Update dependenciesfcf8fa9Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream57ecd64fix: support "including kaios" without downstream093a0f6Update EM bannerb637868Release 4.28.7 version313f465Update dependenciesc935c5aFix regexp performanced7e9e65Rewrite structure parsing to make it always fastec4a55eFix import orderMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.