You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/10/20 22:24:43 UTC
[PR] chore(deps): bump @modelcontextprotocol/client from 2.2.0 to 2.3.0 in /packages/mcp [maka]
dependabot[bot] opened a new pull request, #6201:
URL: https://github.com/apache/maka/pull/6201
Bumps [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) from 2.2.0 to 2.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@modelcontextprotocol/client's releases</a>.</em></p>
<blockquote>
<h2><code>@modelcontextprotocol/client</code><a href="https://github.com/2"><code>@2</code></a>.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2901">#2901</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"><code>433eb41</code></a> Thanks <a href="https://github.com/apps/claude"><code>@claude</code></a>! - The HTTP client transports and the OAuth client helpers now follow a redirect only when it stays within the origin of the request (same scheme, host and port, or http to https on the same host with default ports) and keeps the method (a 307 or 308, or any redirect of a GET). Any other redirect is not followed. A transport then fails the request with an error that names the target; the session is kept and later messages still send. OAuth metadata discovery moves on to the next well-known URL, and any other OAuth request fails with an error that gives the status. Same-origin redirects that keep the method keep working on Node, up to five in a row, and no code changes are ne
eded there. If your endpoint redirects to another origin, configure the transport with the URL it redirects to. A <code>requestInit.redirect</code> of <code>'error'</code> or <code>'manual'</code> is passed to fetch as it is for the requests a transport sends to the server (POST, GET and DELETE of the Streamable HTTP transport, POST of the SSE transport); for its OAuth requests, and for any other value, <code>requestInit.redirect</code> is not consulted by default. Browsers do not expose the target of a redirect to a page, so there a redirected request fails instead of being followed. Setting <code>redirectPolicy: 'follow'</code> on a transport leaves its redirects to the fetch implementation, as before this change.</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2599">#2599</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5238fba4424f82ec1ae9f6f458dd655ab322062d"><code>5238fba</code></a> Thanks <a href="https://github.com/freya0926"><code>@freya0926</code></a>! - A server can now serve, and a client can now call, <code>tasks/get</code> and <code>tasks/cancel</code> of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when <code>ctx.era === 'legacy'</code>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2846">#2846</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/63c0fcab49dc13f22dd7d016d6320c62d05e3ca8"><code>63c0fca</code></a> Thanks <a href="https://github.com/Sthreal"><code>@Sthreal</code></a>! - Receiving a large message as a single SSE event over Streamable HTTP, such as a tool result of tens of megabytes, is now fast: a 50 MB result that took about 13 seconds arrives in under a second. The client now requires <code>eventsource-parser</code> 3.0.8 or later. <code>SSEClientTransport</code> reads through the <code>eventsource</code> package and gets the same speed-up once that also resolves <code>eventsource-parser</code> 3.0.8 or later.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2908">#2908</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1"><code>633dd3e</code></a> Thanks <a href="https://github.com/apps/claude"><code>@claude</code></a>! - The <code>license</code> field of the package manifests is now <code>Apache-2.0</code>; the <code>LICENSE</code> file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2903">#2903</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e765b3be84b7eba1837ba8da84acd6898cc47c65"><code>e765b3b</code></a> Thanks <a href="https://github.com/apps/claude"><code>@claude</code></a>! - With <code>versionNegotiation</code> in <code>'auto'</code> or pin mode, a <code>server/discover</code> probe answered with a 2xx that carries no usable reply (a body that
is not JSON under <code>application/json</code>, a bare <code>204</code>, a missing or unaccepted content type) still rejects <code>connect()</code> with
<code>EraNegotiationFailed</code>; an empty SSE stream or a <code>202</code> surfaces as the probe timeout instead. The message now says
<code>the server answered with an unusable reply (...)</code> instead of reading like a network failure. To connect to a 2025 server behind a front that
answers the probe this way, pass <code>connect(transport, { prior: { kind: 'legacy' } })</code> or use <code>mode: 'legacy'</code>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2905">#2905</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c0cd01a21d867e57b29d7216416b25bf36898292"><code>c0cd01a</code></a> Thanks <a href="https://github.com/apps/claude"><code>@claude</code></a>! - <code>SSEClientTransport</code> now retries the SSE connection once after <code>onUnauthorized()</code> resolves, as documented. If the retry is also answered with 401, <code>start()</code> rejects with <code>SdkHttpError</code> (<code>ClientHttpAuthentication</code>) instead of calling <code>onUnauthorized()</code> again. A 401 on a later reconnect of a stream that had opened still gets one refresh.</p>
</li>
<li>
<p>Updated dependencies [<a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1"><code>633dd3e</code></a>]:</p>
<ul>
<li><code>@modelcontextprotocol/core</code><a href="https://github.com/2"><code>@2</code></a>.3.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a202a3621fcb97918e09fa45d0f9efd2dbdee19b"><code>a202a36</code></a> Version Packages (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2896">#2896</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d731faef167b3df78d4be05f547a134f0e23bcf"><code>2d731fa</code></a> fix(client): refresh again when an SSE retry failed for a reason other than 4...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b6e5c5574e107c33cb6ae33c2e869780f5684c3a"><code>b6e5c55</code></a> test(e2e): cover prompts/get without arguments for prompts with a schema (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2928">#2928</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"><code>40f8f4e</code></a> feat(server): add expectedResource to the bearer-token check (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2929">#2929</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"><code>6d8dbc6</code></a> feat(server): add maxToolInputElements option to limit the number of elements...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2fc49eaf17a6b9ac0810c875cc96d3b949f9522c"><code>2fc49ea</code></a> fix(server): accept prompts/get requests that omit arguments (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2107">#2107</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/63c0fcab49dc13f22dd7d016d6320c62d05e3ca8"><code>63c0fca</code></a> fix(client): update eventsource-parser for large SSE responses (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2846">#2846</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"><code>84804c2</code></a> fix(server): refuse a second connect and stateless transport reuse (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2918">#2918</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e16d27729ea2fae144a6d957fd0372d9eb0e6c58"><code>e16d277</code></a> docs: close idle sessions and cap the session map in the sessions guide and e...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"><code>433eb41</code></a> fix(client): follow redirects only within the origin of the request (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2901">#2901</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.2.0...@modelcontextprotocol/client@2.3.0">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/maka/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] chore(deps): bump @modelcontextprotocol/client from 2.2.0 to 2.3.0 in /packages/mcp [maka]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] closed pull request #6201: chore(deps): bump @modelcontextprotocol/client from 2.2.0 to 2.3.0 in /packages/mcp
URL: https://github.com/apache/maka/pull/6201
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] chore(deps): bump @modelcontextprotocol/client from 2.2.0 to 2.3.0 in /packages/mcp [maka]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] commented on PR #6201:
URL: https://github.com/apache/maka/pull/6201#issuecomment-6364583194
Looks like @modelcontextprotocol/client is up-to-date now, so this is no longer needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org