chore(deps)(deps): bump the minor-and-patch group across 1 directory with 41 updates by dependabot[bot] · Pull Request #109 · archmax-ai/semantics

dependabot · 2026-10-12T11:36:38Z

Bumps the minor-and-patch group with 41 updates in the / directory:

Package	From	To
turbo	`2.10.12`	`2.11.7`
@hono/node-server	`2.1.1`	`2.1.4`
@langchain/core	`1.2.9`	`1.2.17`
@langchain/openai	`1.5.11`	`1.6.2`
@modelcontextprotocol/hono	`2.0.0-alpha.2`	`2.0.2`
@modelcontextprotocol/server	`2.0.0-beta.5`	`2.3.1`
better-auth	`1.7.3`	`1.7.7`
deepagents	`1.13.3`	`1.14.2`
hono	`4.13.7`	`4.13.13`
mongodb	`7.6.0`	`7.7.0`
mongoose	`9.9.5`	`9.11.1`
zod	`4.5.4`	`4.6.5`
@types/node	`26.5.0`	`26.6.4`
tsx	`4.23.13`	`4.23.15`
@astrojs/starlight	`0.42.0`	`0.42.6`
astro	`7.3.2`	`7.3.8`
sharp	`0.35.4`	`0.35.5`
starlight-image-zoom	`0.16.0`	`0.16.1`
@playwright/test	`1.63.0`	`1.64.0`
@tanstack/react-query	`5.102.8`	`5.104.1`
@tanstack/react-router	`1.170.33`	`1.170.41`
@xyflow/react	`12.11.6`	`12.12.0`
lucide-react	`1.43.0`	`1.54.0`
react	`19.2.8`	`19.3.0`
@types/react	`19.2.18`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
@types/react-dom	`19.2.7`	`19.3.0`
@tanstack/router-plugin	`1.168.36`	`1.168.42`
@types/react	`19.2.18`	`19.3.0`
@types/react-dom	`19.2.7`	`19.3.0`
@vitejs/plugin-react	`6.1.1`	`6.1.2`
postcss	`8.5.28`	`8.5.29`
vite	`8.2.2`	`8.3.4`
@langchain/anthropic	`1.5.9`	`1.5.12`
isomorphic-git	`1.41.9`	`1.43.2`
langchain	`1.5.10`	`1.5.16`
@radix-ui/react-label	`2.1.15`	`2.1.16`
@radix-ui/react-separator	`1.1.15`	`1.1.16`
@radix-ui/react-slot	`1.3.3`	`1.4.0`
@radix-ui/react-tooltip	`1.2.16`	`1.3.0`
radix-ui	`1.6.7`	`1.7.0`
react-day-picker	`10.0.1`	`10.0.2`
tailwind-merge	`3.6.0`	`3.7.0`

Updates turbo from 2.10.12 to 2.11.7

Release notes

Sourced from turbo's releases.

Turborepo v2.11.7

What's Changed

Changelog

chore: Release Turborepo 2.11.6 by @github-actions[bot] in vercel/turborepo#14352

fix: Pass SDKROOT through to repository tasks by @anthonyshew in vercel/turborepo#14353

chore: Update with-vite-module-federation example by @vercel-gh-bot-5[bot] in vercel/turborepo#14349

fix: Ignore Vercel OIDC token rotation in .env.local cache inputs by @anthonyshew in vercel/turborepo#14356

Full Changelog: vercel/turborepo@v2.11.6...v2.11.7

Turborepo v2.11.6

What's Changed

Changelog

chore: Release Turborepo 2.11.5 by @github-actions[bot] in vercel/turborepo#14329

fix: Upgrade standalone turbo on installer reruns by @anthonyshew in vercel/turborepo#14330

test: Deflake OpenTelemetry and PTY shutdown tests by @anthonyshew in vercel/turborepo#14331

docs: Document standalone turbo installation by @anthonyshew in vercel/turborepo#14332

ci: Install standalone turbo on Windows with PowerShell by @anthonyshew in vercel/turborepo#14334

fix: Keep Yarn patch resolutions with npm protocol selectors in prune by @anthonyshew in vercel/turborepo#14337

chore: Update with-tailwind example by @vercel-gh-bot-5[bot] in vercel/turborepo#14264

ci: Resolve latest turbo release with workflow token by @anthonyshew in vercel/turborepo#14339

chore: Update with-ultracite example by @vercel-gh-bot-5[bot] in vercel/turborepo#14335

fix: Match production MFE negative lookaheads locally by @kitfoster in vercel/turborepo#13496

docs: Add missing system environment variables and run flags by @BABTUNA in vercel/turborepo#13811

fix: Normalize task inputs consistently for affected detection and hashing by @anthonyshew in vercel/turborepo#14341

feat: Add task tags with configuration inheritance by @anthonyshew in vercel/turborepo#14342

fix: Upgrade brace-expansion to latest compatible releases by @anthonyshew in vercel/turborepo#14347

docs: Point security.txt to Vercel HackerOne program by @swarnava in vercel/turborepo#14346

test: Deflake untracked scan-scope assertions by @anthonyshew in vercel/turborepo#14348

feat: Expose task and package tags in query by @anthonyshew in vercel/turborepo#14343

feat: Filter query tasks and packages by tags by @anthonyshew in vercel/turborepo#14344

feat: Filter tasks by tags in the CLI by @anthonyshew in vercel/turborepo#14345

fix: Complete task query metadata for non-script entrypoints by @anthonyshew in vercel/turborepo#14350

fix: Infer single-package mode for query commands by @anthonyshew in vercel/turborepo#14351

New Contributors

@swarnava made their first contribution in vercel/turborepo#14346

Full Changelog: vercel/turborepo@v2.11.5...v2.11.6

Turborepo v2.11.5

What's Changed

Changelog

... (truncated)

Commits

547747f publish 2.11.7 to registry
3ce82f5 fix: Ignore Vercel OIDC token rotation in .env.local cache inputs (#14356)
8cc3cce chore: Update with-vite-module-federation example (#14349)
41387de fix: Pass SDKROOT through to repository tasks (#14353)
3a2072c chore: Release Turborepo 2.11.6 (#14352)
90718d1 fix: Infer single-package mode for query commands (#14351)
a409ce5 fix: Complete task query metadata for non-script entrypoints (#14350)
bc7c148 feat: Filter tasks by tags in the CLI (#14345)
49d1607 feat: Filter query tasks and packages by tags (#14344)
fba5351 feat: Expose task and package tags in query (#14343)
Additional commits viewable in compare view

Updates @hono/node-server from 2.1.1 to 2.1.4

Release notes

Sourced from @hono/node-server's releases.

v2.1.4

What's Changed

chore: allow hono v5 as a peer dependency by @yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

ci: add autofix.ci by @yusukebe in honojs/node-server#392

fix: type error in early hints and add typecheck to CI by @BlankParticle in honojs/node-server#390

chore: add better benchmarks by @BlankParticle in honojs/node-server#391

docs(readme): update the benchmark by @yusukebe in honojs/node-server#394

test(request): accept asynchronous body read errors by @usualoma in honojs/node-server#403

fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

d57ed9b 2.1.4
92b014c chore: allow hono v5 as a peer dependency (#406)
720ac78 2.1.3
9821792 Merge commit from fork
35bca95 2.1.2
90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
fe7467c test(request): accept asynchronous body read errors (#403)
64dc09e docs(readm): update the benchmark (#394)
8f505ae chore: add better benchmarks (#391)
2469b1a fix: type error in early hints and add typecheck to CI (#390)
Additional commits viewable in compare view

Updates @langchain/core from 1.2.9 to 1.2.17

Release notes

Sourced from @langchain/core's releases.

@langchain/core@1.2.17

Patch Changes

#11849 b1d9c7a Thanks @KyleCodes! - Preserve runtime context in ambient runnable config across tool calls, nested runnables, and streaming.

@langchain/core@1.2.16

Patch Changes

#11847 bb50952 Thanks @hntrl! - fix(core): expose branded class type for provider declarations

@langchain/core@1.2.14

Patch Changes

#11771 bbed273 Thanks @thushanth-bengre-langchain! - Add fileMimeTypes to ModelProfile so models can advertise the MIME types they accept as generic file inputs. OpenAI Responses API models now report the file types input_file supports; Chat Completions profiles are unchanged.

@langchain/core@1.2.13

Patch Changes

#11714 a83dfb1 Thanks @ccurme! - Abbreviate long tool-call IDs when formatting chat messages as strings, keeping original messages unchanged.

@langchain/core@1.2.12

Patch Changes

#11675 030a726 Thanks @hntrl! - Preserve structured tool arguments in tracer run inputs.

@langchain/core@1.2.11

Patch Changes

#11603 fec9cd8 Thanks @thushanth-bengre-langchain! - fix(core): build streaming llmOutput.tokenUsage from the fully-accumulated chunk instead of whichever individual chunk's usage_metadata arrived last

Affects both core streaming paths — .stream()/.streamEvents() (_streamIterator) and .invoke()/.generate() when a streaming-preferring callback is attached (_generateWithCache's hasStreamingHandler branch). Previously, llmOutput.tokenUsage was overwritten by each chunk in turn, so only the last chunk carrying usage_metadata won — correct for providers that emit one cumulative total on a final chunk, but wrong for providers (e.g. @langchain/google, @langchain/anthropic) that emit usage_metadata as a per-chunk delta across multiple chunks, where the values must be summed.

Note for provider authors: this assumes each streamed chunk's usage_metadata is either a per-chunk delta or appears only on a single final chunk. A provider that instead repeats a cumulative total on every chunk will now see it summed (and inflated) in llmOutput.tokenUsage, matching the existing behavior of the correctly-working message.usage_metadata field.

Also fixes @langchain/google's invoke({streaming: true}) path (no streaming-preferring callback attached), where llmOutput was never populated at all.

#11590 ffebdc2 Thanks @thushanth-bengre-langchain! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses response_metadata.output directly, preserving every reasoning item's id/encrypted_content in original order. In v1, AIMessage.contentBlocks (outputVersion: "v1") is fixed the same way. additional_kwargs.reasoning is unchanged.

@langchain/core@1.2.10

Patch Changes

#10047 ff1248f Thanks @afirstenberg! - fix(core): BaseMessage.text use contentBlocks

Commits

59776b1 chore: version packages (#11874)
b1d9c7a fix(core): preserve ambient runtime context across tool calls (#11849)
5dfb0cb chore: version packages (#11848)
bb50952 fix(core): expose branded class type for provider declarations (#11847)
5a86552 chore: version packages (#11826)
1b5ac16 fix(mcp-adapters): use a single underscore for server tool prefixes (#11845)
0552450 fix(mcp-adapters): keep the SDK error as cause after an HTTP→SSE fallback (#1...
f2ff71c chore(deps): bump the minor-and-patch group across 1 directory with 48 update...
71ede02 chore(deps): bump the build-and-test group across 1 directory with 8 updates ...
c4dba61 chore(deps): bump the langchain group across 1 directory with 4 updates (#11791)
Additional commits viewable in compare view

Updates @langchain/openai from 1.5.11 to 1.6.2

Release notes

Sourced from @langchain/openai's releases.

@langchain/openai@1.6.2

Patch Changes

#11707 4109812 Thanks @richardscarrott! - feat(openai): support additional_tools on the Responses API. An additional_tools block on a SystemMessage, either bare in content or wrapped in a non_standard block, is sent verbatim as a top-level input item preceding the message.

additional_tools cannot work anywhere else, so it now throws instead of being dropped: on Chat Completions (set useResponsesApi: true), or on any message other than a SystemMessage. Assistant messages are exempt.

#11707 4109812 Thanks @richardscarrott! - fix(openai): accept non_standard-wrapped configuration_update and mcp_approval_response blocks. Previously only a bare block in content was hoisted to a top-level Responses API input item; a wrapped block, or one on a message built with contentBlocks, was silently dropped. Chat Completions now also sends the payload of a non_standard block rather than the wrapper.

@langchain/openai@1.6.1

Patch Changes

#11771 bbed273 Thanks @thushanth-bengre-langchain! - Add fileMimeTypes to ModelProfile so models can advertise the MIME types they accept as generic file inputs. OpenAI Responses API models now report the file types input_file supports; Chat Completions profiles are unchanged.

@langchain/openai@1.6.0

Minor Changes

#11232 663b9a2 Thanks @ccurme! - feat(openai): support explicit prompt cache options and content-block breakpoints

Patch Changes

#11735 5d509ad Thanks @thushanth-bengre-langchain! - fix(openai): send promptCacheRetention: "in-memory" as "in_memory" (the API rejects the hyphenated value), and apply promptCacheKey/promptCacheRetention in the same order as promptCacheOptions: per-call option, then modelKwargs, then the constructor field. On Chat Completions, modelKwargs values are no longer dropped and now take precedence over the constructor field.

@langchain/openai@1.5.13

Patch Changes

#11590 ffebdc2 Thanks @thushanth-bengre-langchain! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses response_metadata.output directly, preserving every reasoning item's id/encrypted_content in original order. In v1, AIMessage.contentBlocks (outputVersion: "v1") is fixed the same way. additional_kwargs.reasoning is unchanged.

@langchain/openai@1.5.12

Patch Changes

#11560 6bd3a18 Thanks @thushanth-bengre-langchain! - Support configuration_update content blocks for changing reasoning effort mid-conversation without invalidating the cached prompt prefix.

#11588 7d6e1b0 Thanks @jacoblee93! - fix(openai): Fix base url deserialization

#11534 80c5c93 Thanks @chiliec! - Route gpt-5.6-sol to the Responses API so function tools work with reasoning.

@langchain/openai@1.5.12-rc.0

Patch Changes

#11534 80c5c93 Thanks @chiliec! - Route gpt-5.6-sol to the Responses API so function tools work with reasoning.

Commits

bc4466b chore: version packages (#11788)
4109812 feat(anthropic,openai): support tool changes in system messages (#11707)
63ca83e chore(deps): bump hono from 4.13.5 to 4.13.7 (#11786)
417ddcf chore: version packages (#11749)
bbed273 feat(openai): report Responses API file MIME types in model profile (#11771)
56a7f0b chore(mcp-adapters): release adapter v2 (#11767)
51b3b7b refactor(mcp-adapters): drop config guards that only served 1.x upgrades (#11...
ab0181f feat(mcp-adapters)!: prefix tool names with the server name by default, and r...
347bc0b fix(mcp-adapters): stop cancelled discovery before acquiring another server (...
ba4e7a2 fix(mcp-adapters): return MCP tool errors as error ToolMessages (#11758)
Additional commits viewable in compare view

Updates @modelcontextprotocol/hono from 2.0.0-alpha.2 to 2.0.2

Release notes

Sourced from @modelcontextprotocol/hono's releases.

@modelcontextprotocol/hono@2.0.2

Patch Changes

#2918 84804c2 Thanks @claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

What keeps working without a change:

createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.

A handler that builds a new server and a new stateless transport for each request.

One server and one transport per session (a transport with a sessionIdGenerator).

Connecting a server again after close().

Client.

What fails now, how it shows, and what to change:

One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.

One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.

createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).

One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

Updated dependencies [40f8f4e, 6d8dbc6, 5238fba, 2fc49ea, 4d94e7b, 84804c2, e55f9ac, 633dd3e, 2237555]:

@modelcontextprotocol/server@2.3.0

@modelcontextprotocol/hono@2.0.1

Patch Changes

#2698 7b781ed Thanks @maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport built on it), createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at 4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio bound their reads too) and answers 413 Payload Too Large before anything is parsed. toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy so the modern handler answers it. JSON-RPC batch arrays are limited to 100 messages; a longer batch is answered 400 / -32600 and none of it is dispatched.

The limit is configurable with a new maxRequestBodySize option (bytes, default DEFAULT_MAX_REQUEST_BODY_SIZE = 4 MiB, exported from @modelcontextprotocol/server) on WebStandardStreamableHTTPServerTransportOptions, CreateMcpHandlerOptions (forwarded to its stateless legacy leg; isLegacyRequest and legacyStatelessFallback take the same option), CreateMcpHonoAppOptions, and ToNodeHandlerOptions / ToWebRequestOptions (the adapter's bound applies before the handler's, so raise both). The bounded reader is exported as readRequestBody for adapter authors. Hosts that pre-parse the body and pass it as parsedBody skip the SDK's read and its size limit entirely; the batch bound applies either way.

... (truncated)

Commits

a202a36 Version Packages (#2896)
2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
40f8f4e feat(server): add expectedResource to the bearer-token check (#2929)
6d8dbc6 feat(server): add maxToolInputElements option to limit the number of elements...
2fc49ea fix(server): accept prompts/get requests that omit arguments (#2107)
63c0fca fix(client): update eventsource-parser for large SSE responses (#2846)
84804c2 fix(server): refuse a second connect and stateless transport reuse (#2918)
e16d277 docs: close idle sessions and cap the session map in the sessions guide and e...
433eb41 fix(client): follow redirects only within the origin of the request (#2901)
Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0-beta.5 to 2.3.1

Release notes

Sourced from @modelcontextprotocol/server's releases.

@modelcontextprotocol/server-legacy@2.3.1

Patch Changes

#2952 5a18673 Thanks @claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/server@2.3.1

Patch Changes

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/server-legacy@2.3.0

Patch Changes

#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

Updated dependencies [633dd3e]:

@modelcontextprotocol/core@2.3.0

@modelcontextprotocol/server@2.3.0

Minor Changes

#2929 40f8f4e Thanks @claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

#2926 6d8dbc6 Thanks @claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

#2918 84804c2 Thanks @claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

What keeps working without a change:

createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.

A handler that builds a new server and a new stateless transport for each request.

One server and one transport per session (a transport with a sessionIdGenerator).

Connecting a server again after close().

Client.

What fails now, how it shows, and what to change:

One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.

One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.

createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).

One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

#2907 e55f9ac Thanks @claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits

fcef852 Version Packages (#2953)
e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
3ab61c6 docs: update the README banners (#2940)
8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
33fecfb test(e2e): cover tools/call without arguments (#2933)
818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
a202a36 Version Packages (#2896)
2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
Additional commits viewable in compare view

Updates better-auth from 1.7.3 to 1.7.7

Release notes

Sourced from better-auth's releases.

v1.7.7

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

Fixed a critical Magic Link account-takeover vulnerability. (#11494)

Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)

Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the

…with 41 updates Bumps the minor-and-patch group with 41 updates in the / directory: | Package | From | To | | --- | --- | --- | | [turbo](https://github.com/vercel/turborepo) | `2.10.12` | `2.11.7` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.4` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.9` | `1.2.17` | | [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.11` | `1.6.2` | | [@modelcontextprotocol/hono](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0-alpha.2` | `2.0.2` | | [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.0.0-beta.5` | `2.3.1` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.3` | `1.7.7` | | [deepagents](https://github.com/langchain-ai/deepagentsjs) | `1.13.3` | `1.14.2` | | [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.13` | | [mongodb](https://github.com/mongodb/node-mongodb-native) | `7.6.0` | `7.7.0` | | [mongoose](https://github.com/Automattic/mongoose) | `9.9.5` | `9.11.1` | | [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.4` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.42.0` | `0.42.6` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.2` | `7.3.8` | | [sharp](https://github.com/lovell/sharp) | `0.35.4` | `0.35.5` | | [starlight-image-zoom](https://github.com/HiDeoo/starlight-image-zoom/tree/HEAD/packages/starlight-image-zoom) | `0.16.0` | `0.16.1` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.8` | `5.104.1` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.33` | `1.170.41` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.6` | `12.12.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.43.0` | `1.54.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | | [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.36` | `1.168.42` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.29` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.4` | | [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) | `1.5.9` | `1.5.12` | | [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.41.9` | `1.43.2` | | [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.10` | `1.5.16` | | [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.15` | `2.1.16` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/separator) | `1.1.15` | `1.1.16` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.3.3` | `1.4.0` | | [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.16` | `1.3.0` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.7.0` | | [react-day-picker](https://github.com/gpbl/react-day-picker/tree/HEAD/packages/react-day-picker) | `10.0.1` | `10.0.2` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` | Updates `turbo` from 2.10.12 to 2.11.7 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.12...v2.11.7) Updates `@hono/node-server` from 2.1.1 to 2.1.4 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.1...v2.1.4) Updates `@langchain/core` from 1.2.9 to 1.2.17 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.9...@langchain/core@1.2.17) Updates `@langchain/openai` from 1.5.11 to 1.6.2 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.11...@langchain/openai@1.6.2) Updates `@modelcontextprotocol/hono` from 2.0.0-alpha.2 to 2.0.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/hono@2.0.0-alpha.2...@modelcontextprotocol/hono@2.0.2) Updates `@modelcontextprotocol/server` from 2.0.0-beta.5 to 2.3.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.0.0-beta.5...@modelcontextprotocol/server@2.3.1) Updates `better-auth` from 1.7.3 to 1.7.7 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/better-auth) Updates `deepagents` from 1.13.3 to 1.14.2 - [Release notes](https://github.com/langchain-ai/deepagentsjs/releases) - [Commits](https://github.com/langchain-ai/deepagentsjs/compare/deepagents@1.13.3...deepagents@1.14.2) Updates `hono` from 4.13.7 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.7...v4.13.13) Updates `mongodb` from 7.6.0 to 7.7.0 - [Release notes](https://github.com/mongodb/node-mongodb-native/releases) - [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md) - [Commits](mongodb/node-mongodb-native@v7.6.0...v7.7.0) Updates `mongoose` from 9.9.5 to 9.11.1 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.9.5...9.11.1) Updates `zod` from 4.5.4 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.5.4...v4.6.5) Updates `@types/node` from 26.5.0 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `@astrojs/starlight` from 0.42.0 to 0.42.6 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.6/packages/starlight) Updates `astro` from 7.3.2 to 7.3.8 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.8/packages/astro) Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) Updates `starlight-image-zoom` from 0.16.0 to 0.16.1 - [Release notes](https://github.com/HiDeoo/starlight-image-zoom/releases) - [Changelog](https://github.com/HiDeoo/starlight-image-zoom/blob/main/packages/starlight-image-zoom/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-image-zoom/commits/starlight-image-zoom@0.16.1/packages/starlight-image-zoom) Updates `@playwright/test` from 1.63.0 to 1.64.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.0) Updates `@tanstack/react-query` from 5.102.8 to 5.104.1 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.1/packages/react-query) Updates `@tanstack/react-router` from 1.170.33 to 1.170.41 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.41/packages/react-router) Updates `@xyflow/react` from 12.11.6 to 12.12.0 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.0/packages/react) Updates `lucide-react` from 1.43.0 to 1.54.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.54.0/packages/lucide-react) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@tanstack/router-plugin` from 1.168.36 to 1.168.42 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.42/packages/router-plugin) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.7 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react) Updates `postcss` from 8.5.28 to 8.5.29 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.28...8.5.29) Updates `vite` from 8.2.2 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) Updates `@langchain/anthropic` from 1.5.9 to 1.5.12 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/anthropic@1.5.9...@langchain/anthropic@1.5.12) Updates `isomorphic-git` from 1.41.9 to 1.43.2 - [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases) - [Commits](isomorphic-git/isomorphic-git@v1.41.9...v1.43.2) Updates `langchain` from 1.5.10 to 1.5.16 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.10...langchain@1.5.16) Updates `@radix-ui/react-label` from 2.1.15 to 2.1.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label) Updates `@radix-ui/react-separator` from 1.1.15 to 1.1.16 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/separator/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/separator) Updates `@radix-ui/react-slot` from 1.3.3 to 1.4.0 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot) Updates `@radix-ui/react-tooltip` from 1.2.16 to 1.3.0 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip) Updates `radix-ui` from 1.6.7 to 1.7.0 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui) Updates `react-day-picker` from 10.0.1 to 10.0.2 - [Release notes](https://github.com/gpbl/react-day-picker/releases) - [Changelog](https://github.com/gpbl/react-day-picker/blob/main/packages/react-day-picker/CHANGELOG.md) - [Commits](https://github.com/gpbl/react-day-picker/commits/v10.0.2/packages/react-day-picker) Updates `tailwind-merge` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.11.7 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@hono/node-server" dependency-version: 2.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@langchain/core" dependency-version: 1.2.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@langchain/openai" dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@modelcontextprotocol/hono" dependency-version: 2.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@modelcontextprotocol/server" dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: better-auth dependency-version: 1.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: deepagents dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.13.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: mongodb dependency-version: 7.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mongoose dependency-version: 9.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@astrojs/starlight" dependency-version: 0.42.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: astro dependency-version: 7.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: starlight-image-zoom dependency-version: 0.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@playwright/test" dependency-version: 1.64.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.104.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tanstack/react-router" dependency-version: 1.170.41 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@xyflow/react" dependency-version: 12.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: lucide-react dependency-version: 1.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tanstack/router-plugin" dependency-version: 1.168.42 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.29 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@langchain/anthropic" dependency-version: 1.5.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: isomorphic-git dependency-version: 1.43.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: langchain dependency-version: 1.5.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-label" dependency-version: 2.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-slot" dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@radix-ui/react-tooltip" dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: radix-ui dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react-day-picker dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwind-merge dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-12T11:36:41Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-10-12T11:45:05Z

Docker image ready

docker pull ghcr.io/archmax-ai/semantics:pr-109

Navigation Menu

Repository navigation

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 41 updates - #109

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 41 updates#109
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-e3c621d8dd

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026

Turborepo v2.11.7

What's Changed

Changelog

Turborepo v2.11.6

What's Changed

Changelog

New Contributors

Turborepo v2.11.5

What's Changed

Changelog

v2.1.4

What's Changed

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v2.1.2

What's Changed

@​langchain/core@​1.2.17

Patch Changes

@​langchain/core@​1.2.16

Patch Changes

@​langchain/core@​1.2.14

Patch Changes

@​langchain/core@​1.2.13

Patch Changes

@​langchain/core@​1.2.12

Patch Changes

@​langchain/core@​1.2.11

Patch Changes

@​langchain/core@​1.2.10

Patch Changes

@​langchain/openai@​1.6.2

Patch Changes

@​langchain/openai@​1.6.1

Patch Changes

@​langchain/openai@​1.6.0

Minor Changes

Patch Changes

@​langchain/openai@​1.5.13

Patch Changes

@​langchain/openai@​1.5.12

Patch Changes

@​langchain/openai@​1.5.12-rc.0

Patch Changes

@​modelcontextprotocol/hono@​2.0.2

Patch Changes

@​modelcontextprotocol/hono@​2.0.1

Patch Changes

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

@​modelcontextprotocol/server@​2.3.1

Patch Changes

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

@​modelcontextprotocol/server@​2.3.0

Minor Changes

v1.7.7

better-auth

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Oct 12, 2026

Labels

Uh oh!

github-actions Bot commented Oct 12, 2026

Docker image ready

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

`@langchain/core@1`.2.17

`@langchain/core@1`.2.16

`@langchain/core@1`.2.14

`@langchain/core@1`.2.13

`@langchain/core@1`.2.12

`@langchain/core@1`.2.11

`@langchain/core@1`.2.10

`@langchain/openai@1`.6.2

`@langchain/openai@1`.6.1

`@langchain/openai@1`.6.0

`@langchain/openai@1`.5.13

`@langchain/openai@1`.5.12

`@langchain/openai@1`.5.12-rc.0

`@modelcontextprotocol/hono@2`.0.2

`@modelcontextprotocol/hono@2`.0.1

`@modelcontextprotocol/server-legacy@2`.3.1

`@modelcontextprotocol/server@2`.3.1

`@modelcontextprotocol/server-legacy@2`.3.0

`@modelcontextprotocol/server@2`.3.0

`better-auth`