Skip to content

chore(deps): bump js-yaml and agents in /nlweb-template - #1124

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nlweb-template/multi-44aadc475a
Open

chore(deps): bump js-yaml and agents in /nlweb-template#1124
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nlweb-template/multi-44aadc475a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Removes js-yaml. It's no longer used after updating ancestor dependency agents. These dependencies need to be updated together.

Removes js-yaml

Updates agents from 0.2.25 to 0.20.1

Release notes

Sourced from agents's releases.

agents@0.20.1

Patch Changes

  • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

  • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

    Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

    chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

    v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

agents@0.20.0

Minor Changes

  • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

    Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

    The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

    The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

    The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

    The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

    @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

    Deprecations in this release:

    • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
    • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
    • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

    experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

  • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

agents@0.19.0

Minor Changes

  • #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

    The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when

... (truncated)

Changelog

Sourced from agents's changelog.

0.20.1

Patch Changes

  • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

  • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

    Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

    chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

    v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

0.20.0

Minor Changes

  • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

    Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

    The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

    The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

    The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

    The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

    @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

    Deprecations in this release:

    • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
    • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
    • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

    experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

  • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

0.19.0

Minor Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for agents since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
@dependabot
chore(deps): bump js-yaml and agents in /nlweb-template
1bd475a 
Removes [js-yaml](https://github.com/nodeca/js-yaml). It's no longer used after updating ancestor dependency [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents). These dependencies need to be updated together.


Removes `js-yaml`

Updates `agents` from 0.2.25 to 0.20.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.20.1/packages/agents)

---
updated-dependencies:
- dependency-name: agents
  dependency-version: 0.20.1
  dependency-type: direct:production
- dependency-name: js-yaml
  dependency-version:
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/nlweb-template/multi-44aadc475a branch from c69c55e to 1bd475a Compare August 14, 2026 15:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants