[dependabot]

Bumps xmcp from 0.6.13 to 1.9.0.

Release notes

Sourced from xmcp's releases.

xmcp@1.9.0

Minor Changes

• a0f4654: Add optional http.maxSubscriptions to limit concurrent subscription streams per HTTP handler across standalone HTTP, Vercel, Cloudflare, and all HTTP adapters. Set it to 0 to reject subscriptions/listen before opening a stream; omitting it preserves the SDK default. This does not limit stream duration or change ordinary requests, tool-call streaming, or STDIO behavior.

Patch Changes

• d3d89ce: Refresh the package README with current positioning, a tool example, and the full set of integrations, adapters and deployment targets.

xmcp@1.8.0

Minor Changes

• 516fc7a: Expose current-request SDK authentication through RequestContext.authInfo and MCP middleware, including listing operations, without retaining authentication across requests.
• ad824fe: Expose a read-only registered tool metadata snapshot on tools/call MCP middleware as ctx.tool.metadata, with normalized _meta matching discovery results for shared authorization policies.

Patch Changes

• 798942d: Update @modelcontextprotocol/server to 2.3.0.

xmcp@1.7.2

Patch Changes

• f42dd7d: Allow static resources to return inputRequired results so clients can supply input before reading their contents.

xmcp@1.7.1

Patch Changes

• 92163c9: Update the bundled MCP client SDK to 2.2.0 and its optional peer requirement. This includes upstream OAuth issuer binding, input-required result metadata preservation, and pagination fixes.

xmcp@1.7.0

Minor Changes

• 318cc48: Add opt-in experimental.inferToolSchemas to generate tool input validation and descriptions from TypeScript types and JSDoc. Resolve imported types and re-exported handlers, refresh schemas during development, and preserve explicit schema overrides. Unsupported inputs fail compilation with actionable diagnostics.

  Support property JSDoc constraints for numeric bounds, string lengths, regular expressions, and email/URI/UUID formats, with source-located errors for invalid tags. Emit compact string enums with actionable validation errors and native boolean schemas.

xmcp@1.6.0

Minor Changes

• 5948dda: Add Hono and SvelteKit adapters for Node.js and Cloudflare Workers, sharing the stateless Fetch runtime with TanStack Start. Add framework detection, route generation, build ordering, and Workers setup to init-xmcp while preserving host TypeScript configuration.
• 5948dda: Add Nuxt, React Router Framework Mode, and Astro adapters using the shared stateless Fetch runtime, with automatic route setup and Node.js/Cloudflare Workers support.

xmcp@1.5.0

Minor Changes

• a4950f9: Add optional component include/exclude rules by name or tag in xmcp.config.ts. Apply them before registration across tools, prompts, static resources, and resource templates, with generated UI resources following their owning tool.

... (truncated)

Commits

• fb9e709 Version Packages (#751)
• e40a594 chore(deps): bump fastify from 5.12.5 to 5.12.6 (#752)
• ea0fa6a chore(deps): bump next from 16.3.8 to 16.4.1 (#753)
• 4cbebdf Animate blog cover artwork with a particle shader (#756)
• a0f4654 feat(http): cap subscription streams with maxSubscriptions (#661)
• 24f8677 chore(deps): bump nuxt from 4.5.2 to 4.6.2 (#754)
• ae45e0d Polish feature animations, template logos, and code chip alignment (#755)
• 19c4190 chore(deps): bump vite from 6.4.3 to 8.3.5 (#747)
• d3d89ce Refresh the xmcp npm README (#749)
• a0d73bb Add Resend, Paper, Figma, and Profound integrations (#750)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.