Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates - #685

Merged
harlan-zw merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a2163d8f89
Nov 12, 2026
Merged

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates#685
harlan-zw merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a2163d8f89

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
@modelcontextprotocol/sdk 1.30.1 1.32.0
@modelcontextprotocol/server 2.0.0 2.3.0
happy-dom 20.12.0 21.0.4
nuxt 4.6.1 4.6.3
@nuxt/vite-builder 4.6.1 4.6.4
launch-editor 2.14.1 2.14.2
seroval 1.6.8 1.8.0

Updates @modelcontextprotocol/sdk from 1.30.1 to 1.32.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

Commits
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
  • 30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
  • 4b0051f chore: bump version to 1.31.0 (#2890)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0 to 2.3.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • Updated dependencies [633dd3e]:

    • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

  • #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

  • #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

  • #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

    What keeps working without a change:

    • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
    • A handler that builds a new server and a new stateless transport for each request.
    • One server and one transport per session (a transport with a sessionIdGenerator).
    • Connecting a server again after close().
    • Client.

    What fails now, how it shows, and what to change:

    • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
    • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
    • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
    • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

    What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

    The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

  • #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

Patch Changes

  • #2599 5238fba Thanks @​freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.

  • #2107 2fc49ea Thanks @​pragnyanramtha! - prompts/get without arguments no longer fails with "Invalid arguments" when every argument of the prompt is optional. A missing arguments is now validated as {}, as it already is for tools/call, so a top-level .optional() or .default(...) on argsSchema no longer sees undefined.

  • #2889 4d94e7b Thanks @​claude! - registerTool no longer converts tool schemas up front, so a server built per request stops converting every tool on every request. The warning about an invalid x-mcp-header declaration now appears each time tools are listed, not when the tool is registered.

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • #2841 2237555 Thanks @​sharziki! - McpServer.registerPrompt() now types the callback correctly when no argsSchema is given: its one parameter is the server context. Before, reading ctx.mcpReq there was a type error although it worked at runtime. Prompts registered with an argsSchema are unchanged.

  • Updated dependencies [633dd3e]:

    • @​modelcontextprotocol/core@​2.3.0

... (truncated)

Commits
  • a202a36 Version Packages (#2896)
  • 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
  • b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
  • 40f8f4e feat(server): add expectedResource to the bearer-token check (#2929)
  • 6d8dbc6 feat(server): add maxToolInputElements option to limit the number of elements...
  • 2fc49ea fix(server): accept prompts/get requests that omit arguments (#2107)
  • 63c0fca fix(client): update eventsource-parser for large SSE responses (#2846)
  • 84804c2 fix(server): refuse a second connect and stateless transport reuse (#2918)
  • e16d277 docs: close idle sessions and cap the session map in the sessions guide and e...
  • 433eb41 fix(client): follow redirects only within the origin of the request (#2901)
  • Additional commits viewable in compare view

Updates happy-dom from 20.12.0 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

  • Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
  • Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

  • Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

v21.0.1

👷‍♂️ Patch fixes

v21.0.0

💣 Breaking Changes

  • Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
    • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
    • The settings property disableCSSFileLoading has been deprecated
    • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
    • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

👷‍♂️ Patch fixes

v20.14.5

👷‍♂️ Patch fixes

v20.14.4

👷‍♂️ Patch fixes

  • End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

v20.14.2

👷‍♂️ Patch fixes

  • Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

v20.14.0

... (truncated)

Commits
  • fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
  • 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
  • 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
  • 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
  • f55c7e0 chore: Update security documentation (#2509)
  • 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
  • 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
  • f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
  • 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
  • 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
  • Additional commits viewable in compare view

Updates nuxt from 4.6.1 to 4.6.3

Release notes

Sourced from nuxt's releases.

v4.6.3

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

🔥 Performance

  • vite: skip compiling plain style blocks in the server build (#36711)
  • nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
  • vite: avoid quadratic nested dir check for fs.allow (#36702)
  • nuxt: server render internal custom links without RouterLink (#36707)
  • nuxt: skip unneeded typed routes generation (#36645)

🩹 Fixes

  • nitro: don't share prerender hints with self-fetched requests (#36705)
  • nuxt: defer app scope cleanup on external navigation (#36713)
  • nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
  • nuxt: only return redirects from navigateTo while middleware runs (#36650)
  • nuxt: remove purged entries from _asyncData (#36709)
  • vite: skip quoted import.meta keys + limit replace to client dev (#36703)
  • nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
  • nuxt: tree-shake auto-imported #app composables (#36696)
  • nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
  • nuxt: include shared/ in build cache hash (#36704)
  • nuxt: hash keyed function ids + page import names relative to rootDir (#36697)
  • nuxt: encode page paths before matching route rule keys (#36683)
  • nuxt: handle rejected updateCallbackDone of aborted view transition (#36639)
  • ui-templates: keep loading shader proportions on narrow screens (#36654)
  • nuxt: reject case-dependent route rule constraints w/ sensitive: false (#36708)
  • nuxt: don't case-fold regex constraints in route rule keys (#36694)
  • nuxt: normalise page prefix when finding route rule exceptions (#36685)
  • vite: mirror ssr invalidations for created and deleted files (634cba64c)
  • nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
  • deps: update unrouting to v0.3.1 (#36663)
  • nuxt: avoid self-referencing nuxt/schema augmentation (#36633)
  • nuxt: let nightly runtime resolve its own nuxt/* imports (#36632)
  • nuxt: don't warn for vite+ vite.config files (#36628)

... (truncated)

Commits
  • 1b09d0c v4.6.3 (#36651)
  • 4fd54ff test: list NUXT_B4023 as main-only
  • 45463f8 fix(nitro,nuxt): handle dot segments in request paths
  • 57da2ae fix(nuxt): apply redirect route rules to page islands
  • c655a32 fix(nuxt): defer app scope cleanup on external navigation (#36713)
  • e2179ce fix(nuxt): prevent useCookie CookieStore sync from rewriting with refresh (#3...
  • f818b2e fix(nuxt): only return redirects from navigateTo while middleware runs (#36...
  • f5ae355 perf(nitro,nuxt,rspack,webpack): bundle esm vue + reuse caches (#36710)
  • 6761ca2 fix(nuxt): remove purged entries from _asyncData (#36709)
  • 8ef5ede fix(nuxt): hide RouteLocationRaw from navigateTo's public return type (#36691)
  • Additional commits viewable in compare view

Updates @nuxt/vite-builder from 4.6.1 to 4.6.4

Release notes

Sourced from @​nuxt/vite-builder's releases.

v4.6.4

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

  1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
  2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
  3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
  4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
  5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

  • nitro,nuxt: require unrouting 0.3.2 (768d21368)
  • nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
  • nitro: require nitropack 2.13.6 (1b13c6981)
  • nitro: keep leading double slash in renderer request path (75c12c6fb)
  • nuxt: use unambiguous encoding for island hash (6f1b93c64)
  • vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
  • nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
  • nuxt: strip trailing slashes in linear time (97424dd21)
  • nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
  • webpack: skip hot middleware for forbidden dev requests (3c9645326)
  • rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
  • schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
  • nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
  • schema: only widen workspace dir to a declared workspace root (89d3306d1)
  • nitro: only trust x-forwarded-proto in when opted-in (#36818)
  • nitro: stream the body read through a nuxt/server handler (#36817)
  • kit: suggest the specific fix when loading falls back to jiti (24d75659d)
  • vite: use a single type checker (#36774)
  • nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
  • nitro,vite: dedupe dev css by module node (#36420)
  • nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
  • nuxt: only match hydration modifiers after lazy prefix (#36750)
  • kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
  • nuxt: render inlined component styles after stylesheet links (#36714)
  • webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

  • clarify template dependency regeneration (#36766)
  • revise README structure and headings (#36772)
  • link the Nuxt DevTools docs on nuxt.com (#36769)

... (truncated)

Commits
  • b9a6b68 v4.6.4 (#36823)
  • 3e1c796 fix(schema,nitro,vite): add devServer.allowedHosts
  • 89d3306 fix(schema): only widen workspace dir to a declared workspace root
  • 99b85f4 chore(deps): update all non-major dependencies (4.x) (#36820)
  • 731e459 fix(vite): use a single type checker (#36774)
  • 2908015 fix(nitro,vite): remove windows + virtual dev ssr css links after hydration (...
  • d3ee34d fix(nitro,vite): dedupe dev css by module node (#36420)
  • 1b09d0c v4.6.3 (#36651)
  • aec8129 fix(vite): do not read files named in client error reports
  • 12b58f9 fix(vite): deny dev server access to nitro dev output
  • Additional commits viewable in compare view

Updates launch-editor from 2.14.1 to 2.14.2

Commits
  • b533489 v2.14.2
  • f13cd83 fix: check file existence after path resolution (#157)
  • f6e6701 fix: ensure filenames passed to editors are not considered as flags (#156)
  • 3c2f9bf fix: reject paths containing % on windows (#155)
  • ecdfce1 refactor: extract constructWindowsLaunchCommand (#154)
  • 24d5d84 fix: correctly show error when the third parameter is not passed (#153)
  • 7bae9bc refactor: merge statements
  • 571fe00 chore(deps): update actions/setup-node action to v7 (#149)
  • d8ed423 chore(deps): update actions/checkout action to v7 (#148)
  • 75b3e6c fix(deps): update all non-major dependencies (#146)
  • Additional commits viewable in compare view

Updates seroval from 1.6.8 to 1.8.0

Release notes

Sourced from seroval's releases.

seroval-plugins@1.8.0

Minor Changes

  • 7fe0193: The web plugins check their fields with validate. A field with the wrong type now throws SerovalPluginValidationError, as the cause of the decoding error. The ReadableStream plugin now also checks that its source is a stream. seroval-plugins now needs seroval 1.8.0 or newer.

Patch Changes

  • 9250406: The web plugins import from seroval/shared instead of seroval, so a bundle that only reads or only writes does not pull in the other side through them.

seroval@1.8.0

Minor Changes

  • 7fe0193: Add the optional validate plugin field and the v validators. validate lists a validator for each field of a plugin's node. When deserialize reads a listed field with ctx.deserialize, the decoded value is checked first, and SerovalPluginValidationError is thrown if it fails. It applies to fromJSON, fromCrossJSON and createCrossDeserializer. The validators are exported as v from seroval, and as a module from seroval/validator.

  • d1ada33: Add the seroval/read, seroval/write and seroval/shared entry points, so bundlers can put reading and writing in separate chunks.

    • seroval/read exports fromJSON, fromCrossJSON, createCrossDeserializer and deserialize.
    • seroval/write exports the serializers, Serializer and getCrossReferenceHeader.
    • seroval/shared exports what both sides use, such as createPlugin, Feature, Stream and the errors. seroval/read and seroval/write also export it.
    • seroval still exports everything. All entry points load the same chunks, so classes keep one identity.

seroval@1.7.10

Patch Changes

  • 7ae5573: Fix several parser edge cases:

    • The async parser no longer leaves a rejecting promise unhandled while an earlier sibling is still pending.
    • The stream parser removes queued records in constant time, so a consumer that applies backpressure no longer makes emission quadratic.
    • A failed parse no longer leaves ids in a caller-owned refs map, so later calls and Serializer writes define those values again.
    • The stream parser counts only the first settlement of a promise whose then calls back more than once.
    • Arrays with more than 1,000,000 holes are rejected with a SerovalParserError instead of exhausting memory.
    • Buffer and other typed array subclasses serialize as their base typed array, and the typed array size limit applies to them.

seroval@1.7.9

Patch Changes

  • Harden decoding limits.

seroval-plugins@1.7.8

Patch Changes

  • Harden decoding limits.

seroval@1.7.8

Patch Changes

  • Harden string encoding and stream error handling.

seroval-plugins@1.7.7

Patch Changes

... (truncated)

Commits
  • ed09118 Merge pull request #310 from lxsmnsyc/changeset-release/main
  • 295c553 chore: version packages
  • 78dd59f chore(website): update Solid, terracotta and vite dependencies
  • bb2dbe4 fix(website): make the header search button work
  • 560facc Merge pull request #312 from lxsmnsyc/refactor/plugins-shared-imports
  • 23c88d6 Merge branch 'main' into refactor/plugins-shared-imports
  • a042c67 Merge pull request #313 from lxsmnsyc/docs/website-install-og
  • 899a288 Merge branch 'main' into docs/website-install-og
  • fb85be9 Merge branch 'main' into refactor/plugins-shared-imports
  • bcffe32 Merge pull request #311 from lxsmnsyc/chore/plugins-minor
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for seroval since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 7, 2026
@harlan-github-agent harlan-github-agent Bot mentioned this pull request Nov 10, 2026
Open
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 7 up…
bd70e0e 
…dates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.1` | `1.32.0` |
| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0` | `2.3.0` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.12.0` | `21.0.4` |
| [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `4.6.1` | `4.6.3` |
| [@nuxt/vite-builder](https://github.com/nuxt/nuxt/tree/HEAD/packages/vite) | `4.6.1` | `4.6.4` |
| [launch-editor](https://github.com/vitejs/launch-editor) | `2.14.1` | `2.14.2` |
| [seroval](https://github.com/lxsmnsyc/seroval) | `1.6.8` | `1.8.0` |



Updates `@modelcontextprotocol/sdk` from 1.30.1 to 1.32.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.1...1.32.0)

Updates `@modelcontextprotocol/server` from 2.0.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.0.0...@modelcontextprotocol/server@2.3.0)

Updates `happy-dom` from 20.12.0 to 21.0.4
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.12.0...v21.0.4)

Updates `nuxt` from 4.6.1 to 4.6.3
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.6.3/packages/nuxt)

Updates `@nuxt/vite-builder` from 4.6.1 to 4.6.4
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.6.4/packages/vite)

Updates `launch-editor` from 2.14.1 to 2.14.2
- [Commits](vitejs/launch-editor@v2.14.1...v2.14.2)

Updates `seroval` from 1.6.8 to 1.8.0
- [Release notes](https://github.com/lxsmnsyc/seroval/releases)
- [Commits](https://github.com/lxsmnsyc/seroval/compare/seroval@1.6.8...seroval@1.8.0)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.0
  dependency-type: direct:production
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.3.0
  dependency-type: direct:production
- dependency-name: "@nuxt/vite-builder"
  dependency-version: 4.6.4
  dependency-type: indirect
- dependency-name: happy-dom
  dependency-version: 21.0.4
  dependency-type: direct:production
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: indirect
- dependency-name: nuxt
  dependency-version: 4.6.3
  dependency-type: direct:production
- dependency-name: seroval
  dependency-version: 1.7.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-a2163d8f89 branch from 4eba6d7 to bd70e0e Compare November 10, 2026 18:43
This was referenced Nov 10, 2026
Open
Open
@harlan-github-agent @claude
fix(deps): restore server auto-imports and dedupe vue for nuxt 4.6.4
8a63176 
Nuxt 4.6.2 (nuxt/nuxt#36548) made experimental.nitroAutoImports take
effect. compatibilityVersion 5 defaults it to false, so h3 helpers left
the server auto-imports. Our server code and nuxt-auth-utils 0.5
(createError from #imports) still use them, which broke build and
typecheck. Opt back in until both move to nuxt/server.

Nuxt 4.6.4 needs vue ^3.5.44, but the catalog pinned vue 3.5.43. That
installed two Vue copies, and NuxtLink stopped reacting to prop changes,
which failed the setup link test. Bump the pin to 3.5.45.

nuxt-auth-utils 0.6 fixes the import upstream, but it rotates the session
secret to NUXT_APP_SECRET and logs every user out, so it is left for a
separate change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@harlan-zw
harlan-zw merged commit c88c408 into main Nov 12, 2026
7 checks passed
@harlan-zw
harlan-zw deleted the dependabot/npm_and_yarn/npm_and_yarn-a2163d8f89 branch November 12, 2026 01:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@harlan-zw