From 770e17f09c2819c34d1052e7e1b39c9148b7a864 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 09:40:29 +0000 Subject: [PATCH 1/2] Chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates Bumps the npm_and_yarn group with 3 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [fast-uri](https://github.com/fastify/fast-uri) and [ip-address](https://github.com/beaugunderson/ip-address). Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.32.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.32.1) Updates `fast-uri` from 3.1.7 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8) Updates `ip-address` from 10.7.0 to 10.7.4 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](https://github.com/beaugunderson/ip-address/compare/v10.7.0...v10.7.4) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] --- package-lock.json | 22 +++++++++++----------- package.json | 2 +- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index d21d7647..c42f3f26 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,7 +14,7 @@ "@flyingrobots/bijou-tui": "7.2.0", "@flyingrobots/bijou-tui-app": "7.2.0", "@flyingrobots/graft": "0.11.1", - "@modelcontextprotocol/sdk": "^1.29.0", + "@modelcontextprotocol/sdk": "^1.32.1", "diff": "9.0.0", "zod": "4.3.6" }, @@ -942,12 +942,12 @@ } }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.29.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz", - "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==", + "version": "1.32.1", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.1.tgz", + "integrity": "sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", @@ -1771,9 +1771,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "funding": [ { "type": "github", @@ -2045,9 +2045,9 @@ "license": "ISC" }, "node_modules/ip-address": { - "version": "10.7.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz", - "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==", + "version": "10.7.4", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz", + "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/package.json b/package.json index 4165064c..441e4369 100644 --- a/package.json +++ b/package.json @@ -33,7 +33,7 @@ "@flyingrobots/bijou-tui": "7.2.0", "@flyingrobots/bijou-tui-app": "7.2.0", "@flyingrobots/graft": "0.11.1", - "@modelcontextprotocol/sdk": "^1.29.0", + "@modelcontextprotocol/sdk": "^1.32.1", "diff": "9.0.0", "zod": "4.3.6" }, From 0f7e2b8765183ea37dd18766ff917c568fd6e633 Mon Sep 17 00:00:00 2001 From: James Ross Date: Mon, 19 Oct 2026 18:07:17 -0700 Subject: [PATCH 2/2] chore(edict): refresh ReplaceRange proof locks for the dependency bump The npm_and_yarn bump changes package.json and package-lock.json, which the ReplaceRange validation environment pins, so the package-chain job refused the PR before compiling (package.json differs from the validation-environment lock). Same mechanical refresh as #355: the toolchain lock's package and lockfile hashes, the build lock's toolchainLockSha256, the three affected source-closure entries, and the closure digest, recomputed with the input list and algorithm in tests/assert-build-output.mjs. The same computation reproduces main's committed closure digest exactly. No source, compiler, runtime, or executable-subject identity changes; CI's package chain rebuilds through the public compiler and verifies every lock. --- edict/replace-range/edict.build-lock.json | 10 +++++----- edict/replace-range/edict.toolchain-lock.json | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/edict/replace-range/edict.build-lock.json b/edict/replace-range/edict.build-lock.json index 8e291233..17cde352 100644 --- a/edict/replace-range/edict.build-lock.json +++ b/edict/replace-range/edict.build-lock.json @@ -2,10 +2,10 @@ "schema": "jedit.edict-build-lock/v1", "applicationCoordinate": "jedit.text.replace_range@1", "operationCoordinate": "jedit.text.replace_range@1.replaceRange", - "toolchainLockSha256": "54d282d7d1171901a4d118cdf993c4a85b6b99ec260c646326c9651927631504", + "toolchainLockSha256": "8872fe4bf8559e1ca9c96f9c984ff8a7c2ecee33bb357e15e5d42a3376be878c", "sourceClosure": { "schema": "jedit.edict-source-closure/v1", - "digest": "sha256:85c9f5bde8752cc51dbdae2de56709f35736b17ca4bb474d314024a739c0b8df", + "digest": "sha256:b6443e58cdb725fb09078d1709bb3e2ae0dcf994e6de233418b45c84a3f2b4b8", "files": [ { "path": "application/edict.application.json", @@ -17,7 +17,7 @@ }, { "path": "application/edict.toolchain-lock.json", - "sha256": "54d282d7d1171901a4d118cdf993c4a85b6b99ec260c646326c9651927631504" + "sha256": "8872fe4bf8559e1ca9c96f9c984ff8a7c2ecee33bb357e15e5d42a3376be878c" }, { "path": "application/src/ReplaceRange.edict", @@ -85,11 +85,11 @@ }, { "path": "project/package.json", - "sha256": "87cdea23b9312e769f0eed0e2235bc9172b15007dd5de601b4db7c9f73ad6e76" + "sha256": "0b3cd3e406bf712d3adf02cae2188b00e83f47ad6e64515dfdb00969ff375f55" }, { "path": "project/package-lock.json", - "sha256": "f095cd19b74c3b6b2aca60229e88c057bd494212dce1b2ec47a4ce3a4786fdf4" + "sha256": "645862f8275e1fd7cafb3522dba28d71c92ef0c4440149621d0652f43df29e25" } ] }, diff --git a/edict/replace-range/edict.toolchain-lock.json b/edict/replace-range/edict.toolchain-lock.json index c3f689b8..84d78fd9 100644 --- a/edict/replace-range/edict.toolchain-lock.json +++ b/edict/replace-range/edict.toolchain-lock.json @@ -16,11 +16,11 @@ "files": [ { "path": "package.json", - "sha256": "87cdea23b9312e769f0eed0e2235bc9172b15007dd5de601b4db7c9f73ad6e76" + "sha256": "0b3cd3e406bf712d3adf02cae2188b00e83f47ad6e64515dfdb00969ff375f55" }, { "path": "package-lock.json", - "sha256": "f095cd19b74c3b6b2aca60229e88c057bd494212dce1b2ec47a4ce3a4786fdf4" + "sha256": "645862f8275e1fd7cafb3522dba28d71c92ef0c4440149621d0652f43df29e25" }, { "path": ".github/workflows/ci.yml",