Skip to content

deps(mcp)(deps): bump the npm_and_yarn group across 1 directory with 22 updates #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

deps(mcp)(deps): bump the npm_and_yarn group across 1 directory with 22 updates #74

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 12, 2026 •
edited
Loading

Bumps the npm_and_yarn group with 9 updates in the /webai-mcp directory:

Package From To
@modelcontextprotocol/sdk 1.12.0 1.25.2
body-parser 2.2.0 2.2.2
express 5.1.0 5.2.1
@types/express 5.0.2 5.0.6
ws 8.18.2 8.19.0
@types/body-parser 1.19.5 1.19.6
@types/cors 2.8.18 2.8.19
@types/node-fetch 2.6.12 2.6.13
typescript 5.8.3 5.9.3

Updates @modelcontextprotocol/sdk from 1.12.0 to 1.25.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.25.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.1...v1.25.2

1.25.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.0...1.25.1

1.25.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.3...1.25.0

1.24.3

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by pcarleton, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates body-parser from 2.2.0 to 2.2.2

Release notes

Sourced from body-parser's releases.

v2.2.2

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.1...v2.2.2

v2.2.1

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3
Commits

Updates express from 5.1.0 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
Commits

Updates @types/express from 5.0.2 to 5.0.6

Commits

Updates ws from 8.18.2 to 8.19.0

Release notes

Sourced from ws's releases.

8.19.0

Features

  • Added the closeTimeout option (#2308).

Bug fixes

  • Handled a forthcoming breaking change in Node.js core (19984854).

8.18.3

Bug fixes

  • Fixed a spec violation where the Sec-WebSocket-Version header was not added to the HTTP response if the client requested version was either invalid or unacceptable (#2291).
Commits
  • 61349ec [dist] 8.19.0
  • 3f9ffc6 [feature] Introduce the closeTimeout option (#2308)
  • 1998485 [fix] Ensure all remaining data is read as a single chunk
  • 726c373 [doc] Sort options alphabetically
  • b151f1e [ci] Update actions/checkout action to v6
  • dabdd5b [ci] Update actions/setup-node action to v6
  • 86eac5b [ci] Test on node 25
  • 1891e14 [ci] Update actions/setup-node action to v5
  • aa28c77 [ci] Update actions/checkout action to v5
  • dabbdec [dist] 8.18.3
  • Additional commits viewable in compare view

Updates @types/body-parser from 1.19.5 to 1.19.6

Commits

Updates @types/cors from 2.8.18 to 2.8.19

Commits

Updates @types/express from 5.0.2 to 5.0.6

Commits

Updates @types/node-fetch from 2.6.12 to 2.6.13

Commits

Updates typescript from 5.8.3 to 5.9.3

Release notes

Sourced from typescript's releases.

TypeScript 5.9.3

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9 RC

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9 Beta

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • c63de15 Bump version to 5.9.3 and LKG
  • 8428ca4 🤖 Pick PR #62438 (Fix incorrectly ignored dts file fr...) into release-5.9 (#...
  • a131cac 🤖 Pick PR #62351 (Add missing Float16Array constructo...) into release-5.9 (#...
  • 0424333 🤖 Pick PR #62423 (Revert PR 61928) into release-5.9 (#62425)
  • bdb641a 🤖 Pick PR #62311 (Fix parenthesizer rules for manuall...) into release-5.9 (#...
  • 0d9b9b9 🤖 Pick PR #61978 (Restructure CI to prepare for requi...) into release-5.9 (#...
  • 2dce0c5 Intentionally regress one buggy declaration output to an older version (#62163)
  • 5be3346 Bump version to 5.9.2 and LKG
  • ad825f2 Bump version to 5.9.1-rc and LKG
  • 463a5bf Update LKG
  • Additional commits viewable in compare view

Updates @types/http-errors from 2.0.4 to 2.0.5

Commits

Updates @types/serve-static from 1.15.7 to 2.2.0

Commits

Updates ajv from 6.12.6 to 8.17.1

Release notes

Sourced from ajv's releases.

v8.17.1

What's Changed

Full Changelog: ajv-validator/ajv@v8.17.0...v8.17.1

Plus everything in 8.17.0 which failed to release

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

Revert "Revert fast-uri change (ajv-validator/ajv#2444)" by @​gurgunday in ajv-validator/ajv#2448 fix: ignore new eslint error for @​typescript-eslint/no-extraneous-class by @​jasoniangreen in ajv-validator/ajv#2455 docs: clarify behaviour of addVocabulary by @​jasoniangreen in ajv-validator/ajv#2454 docs: refactor to improve legibility by @​blottn in ajv-validator/ajv#2432 Fix grammatical typo in managing-schemas.md by @​wetneb in ajv-validator/ajv#2305 docs: Fix broken strict-mode link by @​alexanderjsx in ajv-validator/ajv#2459 feat: add test for encoded refs and bump fast-uri by @​jasoniangreen in ajv-validator/ajv#2449 fix: changes for @​typescript-eslint/array-type rule by @​jasoniangreen in ajv-validator/ajv#2467 fixes ajv-validator/ajv#2217 - clarify custom keyword naming by @​jasoniangreen in ajv-validator/ajv#2457

v8.17.0

What's Changed

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

New Contributors

Full Changelog: ajv-validator/ajv@v8.16.0...v8.17.0

v8.16.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.15.0...v8.16.0

... (truncated)

Commits

Updates debug from 4.4.1 to 4.4.3

Release notes

Sourced from debug's releases.

4.4.3

Functionally identical release to 4.4.1.

Version 4.4.2 is compromised. Please see debug-js/debug#1005.

Commits

Updates form-data from 4.0.2 to 4.0.5

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config 58c25d7
  • [meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

Commits

  • [eslint] use a shared config 426ba9a
  • [eslint] fix some spacing issues 2094191
  • [Refactor] use hasown 81ab41b
  • [Fix] validate boundary type in setBoundary() method 8d8e469
  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
  • [Dev Deps] remove unused deps 870e4e6
  • [meta] remove local commit hooks e6e83cc
  • [Dev Deps] update eslint 4066fd6
  • [meta] fix scripts to use prepublishOnly c4bbb13
Changelog

Sourced from form-data's changelog.

v4.0.5 - 2025-11-17

Commits

  • [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
  • [Dev Deps] update @ljharb/eslint-config, eslint 5822467
  • [Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config

@dependabot
deps(mcp)(deps): bump the npm_and_yarn group across 1 directory with …
7801765 
…22 updates

Bumps the npm_and_yarn group with 9 updates in the /webai-mcp directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.12.0` | `1.25.2` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.2.2` |
| [express](https://github.com/expressjs/express) | `5.1.0` | `5.2.1` |
| [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `5.0.2` | `5.0.6` |
| [ws](https://github.com/websockets/ws) | `8.18.2` | `8.19.0` |
| [@types/body-parser](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/body-parser) | `1.19.5` | `1.19.6` |
| [@types/cors](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/cors) | `2.8.18` | `2.8.19` |
| [@types/node-fetch](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node-fetch) | `2.6.12` | `2.6.13` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.8.3` | `5.9.3` |



Updates `@modelcontextprotocol/sdk` from 1.12.0 to 1.25.2
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.12.0...v1.25.2)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `express` from 5.1.0 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.1.0...v5.2.1)

Updates `@types/express` from 5.0.2 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `ws` from 8.18.2 to 8.19.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.2...8.19.0)

Updates `@types/body-parser` from 1.19.5 to 1.19.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/body-parser)

Updates `@types/cors` from 2.8.18 to 2.8.19
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/cors)

Updates `@types/express` from 5.0.2 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/node-fetch` from 2.6.12 to 2.6.13
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node-fetch)

Updates `typescript` from 5.8.3 to 5.9.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.8.3...v5.9.3)

Updates `@types/http-errors` from 2.0.4 to 2.0.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/http-errors)

Updates `@types/serve-static` from 1.15.7 to 2.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/serve-static)

Updates `ajv` from 6.12.6 to 8.17.1
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v6.12.6...v8.17.1)

Updates `debug` from 4.4.1 to 4.4.3
- [Release notes](https://github.com/debug-js/debug/releases)
- [Commits](debug-js/debug@4.4.1...4.4.3)

Updates `form-data` from 4.0.2 to 4.0.5
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.2...v4.0.5)

Updates `http-errors` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/jshttp/http-errors/releases)
- [Changelog](https://github.com/jshttp/http-errors/blob/master/HISTORY.md)
- [Commits](jshttp/http-errors@v2.0.0...v2.0.1)

Updates `iconv-lite` from 0.6.3 to 0.7.2
- [Release notes](https://github.com/pillarjs/iconv-lite/releases)
- [Changelog](https://github.com/pillarjs/iconv-lite/blob/master/Changelog.md)
- [Commits](pillarjs/iconv-lite@v0.6.3...v0.7.2)

Updates `json-schema-traverse` from 0.4.1 to 1.0.0
- [Release notes](https://github.com/epoberezkin/json-schema-traverse/releases)
- [Commits](epoberezkin/json-schema-traverse@v0.4.1...v1.0.0)

Updates `qs` from 6.14.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.14.1)

Updates `raw-body` from 3.0.0 to 3.0.2
- [Release notes](https://github.com/stream-utils/raw-body/releases)
- [Changelog](https://github.com/stream-utils/raw-body/blob/master/HISTORY.md)
- [Commits](stream-utils/raw-body@v3.0.0...v3.0.2)

Updates `statuses` from 2.0.1 to 2.0.2
- [Release notes](https://github.com/jshttp/statuses/releases)
- [Changelog](https://github.com/jshttp/statuses/blob/master/HISTORY.md)
- [Commits](jshttp/statuses@v2.0.1...v2.0.2)

Updates `zod` from 3.25.28 to 4.3.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.28...v4.3.5)

Updates `zod-to-json-schema` from 3.24.5 to 3.25.1
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.25.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm_and_yarn
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm_and_yarn
- dependency-name: "@types/body-parser"
  dependency-version: 1.19.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: "@types/cors"
  dependency-version: 2.8.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: "@types/node-fetch"
  dependency-version: 2.6.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: typescript
  dependency-version: 5.9.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm_and_yarn
- dependency-name: "@types/http-errors"
  dependency-version: 2.0.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: "@types/serve-static"
  dependency-version: 2.2.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 8.17.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm_and_yarn
- dependency-name: debug
  dependency-version: 4.4.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: http-errors
  dependency-version: 2.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: iconv-lite
  dependency-version: 0.7.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm_and_yarn
- dependency-name: json-schema-traverse
  dependency-version: 1.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: raw-body
  dependency-version: 3.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: statuses
  dependency-version: 2.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm_and_yarn
- dependency-name: zod
  dependency-version: 4.3.5
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm_and_yarn
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 12, 2026

Labels

The following labels could not be found: dependency-updates, mcp-package. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from cpjet64 as a code owner January 12, 2026 10:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpjet64 cpjet64 Awaiting requested review from cpjet64 cpjet64 is a code owner

Assignees

@cpjet64 cpjet64

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cpjet64