Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates - #685

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a2163d8f89
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates#685
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a2163d8f89

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
@modelcontextprotocol/sdk 1.30.1 1.32.0
@modelcontextprotocol/server 2.0.0 2.3.0
happy-dom 20.12.0 21.0.4
nuxt 4.6.1 4.6.3
@nuxt/vite-builder 4.6.1 4.6.4
launch-editor 2.14.1 2.14.2
seroval 1.6.8 1.7.9

Updates @modelcontextprotocol/sdk from 1.30.1 to 1.32.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

Commits
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
  • 30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
  • 4b0051f chore: bump version to 1.31.0 (#2890)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0 to 2.3.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • Updated dependencies [633dd3e]:

    • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

  • #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

  • #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

  • #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

    What keeps working without a change:

    • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
    • A handler that builds a new server and a new stateless transport for each request.
    • One server and one transport per session (a transport with a sessionIdGenerator).
    • Connecting a server again after close().
    • Client.

    What fails now, how it shows, and what to change:

    • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
    • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
    • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
    • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

    What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

    The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

  • #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

Patch Changes

  • #2599 5238fba Thanks @​freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.

  • #2107 2fc49ea Thanks @​pragnyanramtha! - prompts/get without arguments no longer fails with "Invalid arguments" when every argument of the prompt is optional. A missing arguments is now validated as {}, as it already is for tools/call, so a top-level .optional() or .default(...) on argsSchema no longer sees undefined.

  • #2889 4d94e7b Thanks @​claude! - registerTool no longer converts tool schemas up front, so a server built per request stops converting every tool on every request. The warning about an invalid x-mcp-header declaration now appears each time tools are listed, not when the tool is registered.

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • #2841 2237555 Thanks @​sharziki! - McpServer.registerPrompt() now types the callback correctly when no argsSchema is given: its one parameter is the server context. Before, reading ctx.mcpReq there was a type error although it worked at runtime. Prompts registered with an argsSchema are unchanged.

  • Updated dependencies [633dd3e]:

    • @​modelcontextprotocol/core@​2.3.0

... (truncated)

Commits
  • a202a36 Version Packages (#2896)
  • 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
  • b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
  • 40f8f4e feat(server): add expectedResource to the bearer-token check (#2929)
  • 6d8dbc6 feat(server): add maxToolInputElements option to limit the number of elements...
  • 2fc49ea fix(server): accept prompts/get requests that omit arguments (#2107)
  • 63c0fca fix(client): update eventsource-parser for large SSE responses (#2846)
  • 84804c2 fix(server): refuse a second connect and stateless transport reuse (#2918)
  • e16d277 docs: close idle sessions and cap the session map in the sessions guide and e...
  • 433eb41 fix(client): follow redirects only within the origin of the request (#2901)
  • Additional commits viewable in compare view

Updates happy-dom from 20.12.0 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

  • Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
  • Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

  • Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

v21.0.1

👷‍♂️ Patch fixes

v21.0.0

💣 Breaking Changes

  • Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
    • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
    • The settings property disableCSSFileLoading has been deprecated
    • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
    • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

👷‍♂️ Patch fixes

v20.14.5

👷‍♂️ Patch fixes

v20.14.4

👷‍♂️ Patch fixes

  • End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

v20.14.2

👷‍♂️ Patch fixes

  • Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

v20.14.0

... (truncated)

Commits
  • fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
  • 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
  • 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
  • 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
  • f55c7e0 chore: Update security documentation (#2509)
  • 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
  • 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
  • f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
  • 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
  • 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
  • Additional commits viewable in compare view

Updates nuxt from 4.6.1 to 4.6.3

Release notes

Sourced from nuxt's releases.

v4.6.3

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

🔥 Performance

  • vite: skip compiling plain style blocks in the server build (#36711)
  • nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
  • vite: avoid quadratic nested dir check for fs.allow (#36702)
  • nuxt: server render internal custom links without RouterLink (#36707)
  • nuxt: skip unneeded typed routes generation (#36645)

🩹 Fixes

  • nitro: don't share prerender hints with self-fetched requests (#36705)
  • nuxt: defer app scope cleanup on external navigation (#36713)
  • nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
  • nuxt: only return redirects from navigateTo while middleware runs (#36650)
  • nuxt: remove purged entries from _asyncData (#36709)
  • vite: skip quoted import.meta keys + limit replace to client dev (#36703)
  • nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
  • nuxt: tree-shake auto-imported #app composables (#36696)
  • nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
  • nuxt: include shared/ in build cache hash (#36704)
  • nuxt: hash keyed function ids + page import names relative to rootDir (#36697)
  • nuxt: encode page paths before matching route rule keys (#36683)
  • nuxt: handle rejected updateCallbackDone of aborted view transition (#36639)
  • ui-templates: keep loading shader proportions on narrow screens (#36654)
  • nuxt: reject case-dependent route rule constraints w/ sensitive: false (#36708)
  • nuxt: don't case-fold regex constraints in route rule keys (#36694)
  • nuxt: normalise page prefix when finding route rule exceptions (#36685)
  • vite: mirror ssr invalidations for created and deleted files (634cba64c)
  • nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
  • deps: update unrouting to v0.3.1 (#36663)
  • nuxt: avoid self-referencing nuxt/schema augmentation (#36633)
  • nuxt: let nightly runtime resolve its own nuxt/* imports (#36632)
  • nuxt: don't warn for vite+ vite.config files (#36628)

... (truncated)

Commits
  • 1b09d0c v4.6.3 (#36651)
  • 4fd54ff test: list NUXT_B4023 as main-only
  • 45463f8 fix(nitro,nuxt): handle dot segments in request paths
  • 57da2ae fix(nuxt): apply redirect route rules to page islands
  • c655a32 fix(nuxt): defer app scope cleanup on external navigation (#36713)
  • e2179ce fix(nuxt): prevent useCookie CookieStore sync from rewriting with refresh (#3...
  • f818b2e fix(nuxt): only return redirects from navigateTo while middleware runs (#36...
  • f5ae355 perf(nitro,nuxt,rspack,webpack): bundle esm vue + reuse caches (#36710)
  • 6761ca2 fix(nuxt): remove purged entries from _asyncData (#36709)
  • 8ef5ede fix(nuxt): hide RouteLocationRaw from navigateTo's public return type (#36691)
  • Additional commits viewable in compare view

Updates @nuxt/vite-builder from 4.6.1 to 4.6.4

Release notes

Sourced from @​nuxt/vite-builder's releases.

v4.6.4

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

  1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
  2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
  3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
  4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
  5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

  • nitro,nuxt: require unrouting 0.3.2 (768d21368)
  • nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
  • nitro: require nitropack 2.13.6 (1b13c6981)
  • nitro: keep leading double slash in renderer request path (75c12c6fb)
  • nuxt: use unambiguous encoding for island hash (6f1b93c64)
  • vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
  • nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
  • nuxt: strip trailing slashes in linear time (97424dd21)
  • nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
  • webpack: skip hot middleware for forbidden dev requests (3c9645326)
  • rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
  • schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
  • nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
  • schema: only widen workspace dir to a declared workspace root (89d3306d1)
  • nitro: only trust x-forwarded-proto in when opted-in (#36818)
  • nitro: stream the body read through a nuxt/server handler (#36817)
  • kit: suggest the specific fix when loading falls back to jiti (24d75659d)
  • vite: use a single type checker (#36774)
  • nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
  • nitro,vite: dedupe dev css by module node (#36420)
  • nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
  • nuxt: only match hydration modifiers after lazy prefix (#36750)
  • kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
  • nuxt: render inlined component styles after stylesheet links (#36714)
  • webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

  • clarify template dependency regeneration (#36766)
  • revise README structure and headings (#36772)
  • link the Nuxt DevTools docs on nuxt.com (#36769)

... (truncated)

Commits
  • b9a6b68 v4.6.4 (#36823)
  • 3e1c796 fix(schema,nitro,vite): add devServer.allowedHosts
  • 89d3306 fix(schema): only widen workspace dir to a declared workspace root
  • 99b85f4 chore(deps): update all non-major dependencies (4.x) (#36820)
  • 731e459 fix(vite): use a single type checker (#36774)
  • 2908015 fix(nitro,vite): remove windows + virtual dev ssr css links after hydration (...
  • d3ee34d fix(nitro,vite): dedupe dev css by module node (#36420)
  • 1b09d0c v4.6.3 (#36651)
  • aec8129 fix(vite): do not read files named in client error reports
  • 12b58f9 fix(vite): deny dev server access to nitro dev output
  • Additional commits viewable in compare view

Updates launch-editor from 2.14.1 to 2.14.2

Commits
  • b533489 v2.14.2
  • f13cd83 fix: check file existence after path resolution (#157)
  • f6e6701 fix: ensure filenames passed to editors are not considered as flags (#156)
  • 3c2f9bf fix: reject paths containing % on windows (#155)
  • ecdfce1 refactor: extract constructWindowsLaunchCommand (#154)
  • 24d5d84 fix: correctly show error when the third parameter is not passed (#153)
  • 7bae9bc refactor: merge statements
  • 571fe00 chore(deps): update actions/setup-node action to v7 (#149)
  • d8ed423 chore(deps): update actions/checkout action to v7 (#148)
  • 75b3e6c fix(deps): update all non-major dependencies (#146)
  • Additional commits viewable in compare view

Updates seroval from 1.6.8 to 1.7.9

Release notes

Sourced from seroval's releases.

seroval@1.7.9

Patch Changes

  • Harden decoding limits.

seroval-plugins@1.7.8

Patch Changes

  • Harden decoding limits.

seroval@1.7.8

Patch Changes

  • Harden string encoding and stream error handling.

seroval-plugins@1.7.7

Patch Changes

  • bb4c3fc: Streamed Request payloads now deserialize where stream request bodies are supported. RequestPlugin adds duplex: 'half' to the request options when the body is a ReadableStream, which Chrome 105+ and Node 19.1+ require. Runtimes without stream request bodies ignore the option.

    RequestPlugin also keeps the body of a Request in runtimes without the Request.body getter, such as Firefox. The async parse reads the body with arrayBuffer(), and the stream parse pushes that buffer into a new ReadableStream.

seroval@1.7.7

Patch Changes

  • Serialization reads an object's class from its prototype instead of its constructor property, and reads Date, Temporal, typed array and DataView values through the built-in methods and getters instead of properties on the value. An object whose own constructor names a built-in class is now serialized as a plain object, and an object that only inherits a built-in prototype, such as Object.create(Date.prototype), is rejected.
  • 00e3abf: Bundles that never create a live stream no longer include the LiveStream class: about 570 bytes gzipped less for toJSONAsync, fromJSON or fromCrossJSON on the production ESM build, measured with seroval's bundle size report. An object made with Object.create(LiveStream.prototype) is no longer treated as a live stream.

seroval-plugins@1.7.6

Patch Changes

  • eb60188: Check the File, ImageData, Event and CustomEvent fields during deserialization. The options of each are checked field by field and copied, and ImageData's data must be a Uint8ClampedArray.

seroval@1.7.6

Patch Changes

  • Read a RegExp's pattern and flags through the RegExp.prototype getters, so own source or flags properties on the value no longer change the output.

seroval-plugins@1.7.5

Patch Changes

  • Check the FormData, Headers, Response and Request fields during deserialization.

seroval@1.7.5

Patch Changes

  • d85ec3f: Keep two round-trip cases intact. An object whose own constructor key holds a falsy value, such as { constructor: undefined }, now keeps Object.prototype instead of coming back with a null prototype. A null-prototype object with an own __proto__ key, or any object serialized with Feature.ObjectAssign disabled, no longer turns equal-looking values such as two new Set() into one shared object in serialize, crossSerialize and compileJSON output.

seroval-plugins@1.7.4

Patch Changes

... (truncated)

Commits
  • e957ae2 docs: publish advisories when the fix is released
  • 2f280ce fix: harden decoding limits
  • 7445222 fix: harden string encoding and stream error handling
  • 63997b7 Merge pull request #305 from lxsmnsyc/dependabot/npm_and_yarn/npm_and_yarn-3f...
  • 1092264 chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates
  • 2fa8978 Merge pull request #303 from lxsmnsyc/chore/serialize-cross-dead-branch
  • d9fa9a3 ci: read the pnpm version from the candidate checkout
  • 9b2a6a6 Merge remote-tracking branch 'origin/main' into chore/serialize-cross-dead-br...
  • dd56e87 refactor(parser): drop unused exports and extra awaits
  • fe946df Merge pull request #304 from lxsmnsyc/ci/benchmarks-no-approval
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for seroval since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 7 up…
4eba6d7 
…dates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.1` | `1.32.0` |
| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0` | `2.3.0` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.12.0` | `21.0.4` |
| [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `4.6.1` | `4.6.3` |
| [@nuxt/vite-builder](https://github.com/nuxt/nuxt/tree/HEAD/packages/vite) | `4.6.1` | `4.6.4` |
| [launch-editor](https://github.com/vitejs/launch-editor) | `2.14.1` | `2.14.2` |
| [seroval](https://github.com/lxsmnsyc/seroval) | `1.6.8` | `1.7.9` |



Updates `@modelcontextprotocol/sdk` from 1.30.1 to 1.32.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.1...1.32.0)

Updates `@modelcontextprotocol/server` from 2.0.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.0.0...@modelcontextprotocol/server@2.3.0)

Updates `happy-dom` from 20.12.0 to 21.0.4
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.12.0...v21.0.4)

Updates `nuxt` from 4.6.1 to 4.6.3
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.6.3/packages/nuxt)

Updates `@nuxt/vite-builder` from 4.6.1 to 4.6.4
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.6.4/packages/vite)

Updates `launch-editor` from 2.14.1 to 2.14.2
- [Commits](vitejs/launch-editor@v2.14.1...v2.14.2)

Updates `seroval` from 1.6.8 to 1.7.9
- [Release notes](https://github.com/lxsmnsyc/seroval/releases)
- [Commits](https://github.com/lxsmnsyc/seroval/compare/seroval@1.6.8...seroval@1.7.9)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.3.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: happy-dom
  dependency-version: 21.0.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nuxt
  dependency-version: 4.6.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@nuxt/vite-builder"
  dependency-version: 4.6.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: seroval
  dependency-version: 1.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 7, 2026
@harlan-github-agent harlan-github-agent Bot mentioned this pull request Nov 10, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants