v1.0.0: release audit for the SDK 1.x release branch

.changeset/everything-sdk-floor-1-31.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-everything": patch
+---
+
+Require `@modelcontextprotocol/sdk` 1.31.0 or later (was `^1.30.0`), so an install can no longer resolve an SDK version affected by GHSA-6qxp-vccf-f47h. The advisory concerns the SDK's OAuth client, which this server does not use.

.changeset/filesystem-sdk-floor-1-31.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-filesystem": patch
+---
+
+Require `@modelcontextprotocol/sdk` 1.31.0 or later (was `^1.30.0`), so an install can no longer resolve an SDK version affected by GHSA-6qxp-vccf-f47h. The advisory concerns the SDK's OAuth client, which this server does not use.

.changeset/memory-sdk-floor-1-31.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-memory": patch
+---
+
+Require `@modelcontextprotocol/sdk` 1.31.0 or later (was `^1.30.0`), so an install can no longer resolve an SDK version affected by GHSA-6qxp-vccf-f47h. The advisory concerns the SDK's OAuth client, which this server does not use.

.changeset/sequentialthinking-sdk-floor-1-31.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-sequential-thinking": patch
+---
+
+Require `@modelcontextprotocol/sdk` 1.31.0 or later (was `^1.30.0`), so an install can no longer resolve an SDK version affected by GHSA-6qxp-vccf-f47h. The advisory concerns the SDK's OAuth client, which this server does not use.

package.json

@@ -58,7 +58,7 @@
     "@changesets/changelog-github": "^1.0.1",
     "@changesets/cli": "^3.0.3",
     "@eslint/js": "^10.0.1",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "eslint": "^10.11.0",
     "globals": "^17.12.0",
     "prettier": "3.8.4",
@@ -68,7 +68,13 @@
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "qs": ">=6.15.2",
-    "hono": ">=4.12.21"
+    "qs": ">=6.16.0",
+    "hono": ">=4.13.7",
+    "proxy-addr": "^2.0.8",
+    "ip-address": "^10.7.1",
+    "brace-expansion": "^5.0.12",
+    "fast-uri": "^3.1.8",
+    "nanoid": "^3.3.18",
+    "source-map-js": "^1.2.2"
   }
 }

src/everything/package.json

@@ -34,7 +34,7 @@
     "validate": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm run test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "cors": "^2.8.5",
     "express": "^5.2.1",
     "jszip": "^3.10.1",
@@ -43,9 +43,9 @@
   "devDependencies": {
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.11",
     "shx": "^0.4.0",
     "typescript": "^5.8.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   }
 }

src/fetch/pyproject.toml

@@ -19,7 +19,7 @@ dependencies = [
     "httpx[socks]>=0.27",
     "markdownify>=0.13.1",
     "mcp>=1.29.0,<2",
-    "protego>=0.3.1",
+    "protego>=0.6.2",
     "pydantic>=2.0.0",
     "readabilipy>=0.2.0",
     "requests>=2.32.3",

src/filesystem/package.json

@@ -31,7 +31,7 @@
     "validate": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm run test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "diff": "^8.0.3",
     "glob": "^13.0.6",
     "minimatch": "^10.0.1",
@@ -41,9 +41,9 @@
     "@types/diff": "^5.0.9",
     "@types/minimatch": "^5.1.2",
     "@types/node": "^22",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.11",
     "shx": "^0.4.0",
     "typescript": "^5.8.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   }
 }

src/git/pyproject.toml

@@ -17,7 +17,7 @@ classifiers = [
 ]
 dependencies = [
     "click>=8.1.7",
-    "gitpython>=3.1.50",
+    "gitpython>=3.1.60",
     "mcp>=1.29.0,<2",
     "pydantic>=2.0.0",
 ]

src/memory/package.json

@@ -31,14 +31,14 @@
     "validate": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm run test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {
     "@types/node": "^22",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.11",
     "shx": "^0.4.0",
     "typescript": "^5.8.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   }
 }

src/sequentialthinking/package.json

@@ -31,17 +31,17 @@
     "validate": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm run test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "chalk": "^5.3.0",
     "yargs": "^17.7.2",
     "zod": "^4.0.0"
   },
   "devDependencies": {
     "@types/node": "^22",
     "@types/yargs": "^17.0.32",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.11",
     "shx": "^0.4.0",
     "typescript": "^5.8.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   }
 }