Skip to content

Bump @modelcontextprotocol/sdk and agents - #334

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d29545c96c
Open

Bump @modelcontextprotocol/sdk and agents#334
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d29545c96c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps @modelcontextprotocol/sdk to 1.32.1 and updates ancestor dependency agents. These dependencies need to be updated together.

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view

Updates agents from 0.24.0 to 0.29.0

Release notes

Sourced from agents's releases.

agents@0.29.0

Minor Changes

Patch Changes

  • #2584 3b3a88e Thanks @​ben-reitz! - Browser creates and closes its Browser Run sessions with the binding's typed acquire() and closeSession(), falling back to the HTTP API in fully local dev. See Browser.

  • #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

  • #2604 5d6f5d6 Thanks @​mattzcarey! - createAI takes { accountId, apiToken } in place of binding, to use a gateway in another account or to run outside a Worker. See the models docs.

  • #2622 2c68a71 Thanks @​mattzcarey! - createAI transcribes with @cf/deepgram/nova-3. See the models docs.

  • #2576 b048873 Thanks @​mattzcarey! - createAI no longer uses AI Gateway's deprecated Universal Endpoint. Model ids, now including catalog ids like anthropic/claude-opus-4.8, run on env.AI.run; model objects go to the provider-native path. Adds byokAlias, fixes pi-ai catalog models and dynamic routes, and lets agents/models/opencode take catalog ids. See the models docs.

  • #2589 841cc18 Thanks @​mattzcarey! - createAI resumes a catalog or dynamic route stream that drops mid-answer, with nothing lost or repeated. See the models docs.

  • #2594 cc34652 Thanks @​ben-reitz! - agents/models/pi-ai resolves Claude ids from pi-ai 1.2's gateway catalog under AI Gateway's spelling, anthropic/claude-opus-4.8. See Models for pi-ai.

  • #2594 cc34652 Thanks @​ben-reitz! - Support Pi 1.3: the Pi web search, web fetch, browser, and skills tools return output, and the Pi peer range is now ~1.3.0. See Pi harness.

  • #2621 e80a201 Thanks @​ben-reitz! - PiHarness submit() and steer() now accept pi-durable's entry option, which labels an input with a transcript kind of your own (for example app.approval) instead of pi.user. Before, the harness had no way to pass it. See Label input the user did not type.

  • #2616 65ddec8 Thanks @​ben-reitz! - openPiSessionStore now uses pi-durable's own Durable Object SQLite adapter, so several Pi storages in one object share its operation queue. See Pi harness.

agents@0.28.1

Patch Changes

  • #2571 1bd2bc5 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

  • #2572 b7c6ab9 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

  • #2573 80719a5 Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

  • #2568 46570f5 Thanks @​mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

agents@0.28.0

This release adds two new tools, browser via agents/browser/{pi,ai-sdk,tanstack-ai} allowing an agent to create and manipulate a persistent browser session and web_fetch via agents/webfetch/{pi,ai-sdk,tanstack-ai} that can retrieve most document formats converted into markdown.

Minor Changes

... (truncated)

Changelog

Sourced from agents's changelog.

0.29.0

Minor Changes

Patch Changes

  • #2584 3b3a88e Thanks @​ben-reitz! - Browser creates and closes its Browser Run sessions with the binding's typed acquire() and closeSession(), falling back to the HTTP API in fully local dev. See Browser.

  • #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

  • #2604 5d6f5d6 Thanks @​mattzcarey! - createAI takes { accountId, apiToken } in place of binding, to use a gateway in another account or to run outside a Worker. See the models docs.

  • #2622 2c68a71 Thanks @​mattzcarey! - createAI transcribes with @cf/deepgram/nova-3. See the models docs.

  • #2576 b048873 Thanks @​mattzcarey! - createAI no longer uses AI Gateway's deprecated Universal Endpoint. Model ids, now including catalog ids like anthropic/claude-opus-4.8, run on env.AI.run; model objects go to the provider-native path. Adds byokAlias, fixes pi-ai catalog models and dynamic routes, and lets agents/models/opencode take catalog ids. See the models docs.

  • #2589 841cc18 Thanks @​mattzcarey! - createAI resumes a catalog or dynamic route stream that drops mid-answer, with nothing lost or repeated. See the models docs.

  • #2594 cc34652 Thanks @​ben-reitz! - agents/models/pi-ai resolves Claude ids from pi-ai 1.2's gateway catalog under AI Gateway's spelling, anthropic/claude-opus-4.8. See Models for pi-ai.

  • #2594 cc34652 Thanks @​ben-reitz! - Support Pi 1.3: the Pi web search, web fetch, browser, and skills tools return output, and the Pi peer range is now ~1.3.0. See Pi harness.

  • #2621 e80a201 Thanks @​ben-reitz! - PiHarness submit() and steer() now accept pi-durable's entry option, which labels an input with a transcript kind of your own (for example app.approval) instead of pi.user. Before, the harness had no way to pass it. See Label input the user did not type.

  • #2616 65ddec8 Thanks @​ben-reitz! - openPiSessionStore now uses pi-durable's own Durable Object SQLite adapter, so several Pi storages in one object share its operation queue. See Pi harness.

0.28.1

Patch Changes

  • #2571 1bd2bc5 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

  • #2572 b7c6ab9 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

  • #2573 80719a5 Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

  • #2568 46570f5 Thanks @​mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

0.28.0

Minor Changes

... (truncated)

Commits
  • fc7f59f Version Packages (#2588)
  • 05843e4 fix(chat-recovery): seal a turn after repeated interrupted attempts (#2615)
  • 2c68a71 feat(agents): createAI transcribes with Deepgram Nova-3 (#2622)
  • 5d6f5d6 feat(agents): createAI takes an account id and API token in place of the bind...
  • e80a201 fix(agents): forward pi-durable's input entry through PiHarness.submit (#2621)
  • 65ddec8 refactor(agents): open the pi session store with pi-durable's adapter (#2616)
  • cc34652 fix(agents): support pi-durable 1.3 (#2594)
  • 841cc18 feat(agents): resume dropped /run streams in createAI (#2589)
  • b048873 feat(agents): createAI on env.AI.run and the provider-native path, for the AI...
  • 8c720d3 think, agents: work in a @​cloudflare/computer Workspace (#2560)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump @modelcontextprotocol/sdk and agents
a1c9a3b 
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) to 1.32.1 and updates ancestor dependency [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents). These dependencies need to be updated together.


Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.1)

Updates `agents` from 0.24.0 to 0.29.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.29.0/packages/agents)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: indirect
- dependency-name: agents
  dependency-version: 0.29.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from TeoSlayer as a code owner October 21, 2026 22:02
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 21, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TeoSlayer TeoSlayer Awaiting requested review from TeoSlayer TeoSlayer is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants