Repository navigation
fix: bump the npm_and_yarn group across 2 directories with 4 updates - #2355
Open
dependabot[bot] wants to merge 5 commits into
Conversation
Bumps the npm_and_yarn group with 4 updates in the /docs/knowledge_prototypes/mcp-servers/fetch-mcp directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [brace-expansion](https://github.com/juliangruber/brace-expansion), [fast-uri](https://github.com/fastify/fast-uri) and [proxy-addr](https://github.com/jshttp/proxy-addr). Bumps the npm_and_yarn group with 1 update in the /sdk/typescript directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.31.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...1.31.0) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) Updates `brace-expansion` from 2.1.4 to 2.1.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) Updates `fast-uri` from 3.1.7 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.7...v3.1.8) Updates `proxy-addr` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) Updates `brace-expansion` from 1.1.13 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.31.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
the
documentation
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency ReviewThe following issues were found:
|
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Review status at head f87e4f28: the Closing keyword to open issue check fails on this dependency PR. I am holding approval until the canonical issue linkage or workflow policy is resolved and the check is green. No merge decision is implied by this review.
groupthinking
approved these changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at b63229ebc434d36b4cfc9056e0eb32d3b15ac65d: the earlier issue-link hold is resolved; the current Closing keyword to open issue check passes. The grouped update is scoped to the fetch MCP and TypeScript SDK package locks, with the fetch example now declaring and locking MCP SDK 1.32.2, beyond the patched floor for the four advisories flagged on the previous head. The duplicate Jest suite is corrected. Clean installs and builds passed in both packages, the fetch suite passed 10/10, and a local stdio client/server smoke test exercised all four fetch tools. Hosted checks now show 26 passed and 3 skipped. The TypeScript SDK package has no Jest test files, and the fetch-package audit still reports 14 other package findings.
I approve the code change at this head. This is not a merge recommendation or a complete dependency security verdict: dependency-review still fails after a 3-base/1-head snapshot comparison, and its evidence artifact was not saved. Keep the PR open until that shared evidence check is corrected.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review update — 2026-10-28
Current head
b63229ebc434d36b4cfc9056e0eb32d3b15ac65dis based onba2777d1b008c2148d413e07cc497791966310e0. The grouped update changes the fetch MCP and TypeScript SDK lockfiles. The fetch example now selects its TypeScript Jest tests, avoiding a duplicate compiled JavaScript suite, and declares@modelcontextprotocol/sdk^1.32.2with 1.32.2 locked. That SDK version is beyond the patched floor for the four advisories flagged at the previous head. The generated Dependabot notes below describe the earlier SDK 1.31.0 and fast-uri 3.1.8 targets; they are retained for provenance. The current docs lock uses fast-uri 3.1.9.Validation: clean npm 10 installs and builds passed in both affected packages; the fetch package's full Jest command passed 10/10 tests, and
npm lsconfirmed SDK 1.32.2. The TypeScript SDK package has no Jest test files, so itsnpm testexits 1 without running tests.git diff --checkpassed. A fresh fetch-package npm audit has no SDK finding, but reports 14 other package findings (2 high, 4 moderate, 8 low); this update does not claim to resolve them.Hosted checks at this head finished 25 passed, 3 skipped, 1 failed. Dependency review did not flag a new moderate-or-higher vulnerable package, but GitHub compared 3 base snapshots with 1 head snapshot and the evidence artifact was not saved. That comparison is not a reliable dependency verdict. Keep the PR open and unmerged until the shared snapshot/evidence issue is resolved; no merge decision is implied by this update.
Bumps the npm_and_yarn group with 4 updates in the /docs/knowledge_prototypes/mcp-servers/fetch-mcp directory: @modelcontextprotocol/sdk, brace-expansion, fast-uri and proxy-addr.
Bumps the npm_and_yarn group with 1 update in the /sdk/typescript directory: brace-expansion.
Updates
@modelcontextprotocol/sdkfrom 1.26.0 to 1.31.0Release notes
Sourced from @modelcontextprotocol/sdk's releases.
Commits
4b0051fchore: bump version to 1.31.0 (#2890)51ad4f0[v1.x] Bind stored OAuth credentials to the authorization server that issued ...289ac2cchore: bump version to 1.30.1 (#2848)12b4256fix(auth): preserve resource URI without trailing slash (#1968) (#1972)a9f6eb7[v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...2d889f2chore: bump version to 1.30.0 (#2563)e3f3daaFix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...bb5a718fix(deps): widen@hono/node-serverpast GHSA-frvp-7c67-39w9 (#2549)1dad263fix: send SSE keep-alive comment frames from Streamable HTTP server transport...69749aaValidate Content-Type by parsed media type instead of substring match (v1.x) ...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@modelcontextprotocol/sdksince your current version.Updates
brace-expansionfrom 1.1.18 to 1.1.21Commits
8e81e181.1.21ffdfa3eMerge commit from forkc6513ad1.1.201efee7cMerge commit from forka34340a1.1.190bcbfc0Merge commit from forkUpdates
brace-expansionfrom 2.1.4 to 2.1.7Commits
8e81e181.1.21ffdfa3eMerge commit from forkc6513ad1.1.201efee7cMerge commit from forka34340a1.1.190bcbfc0Merge commit from forkUpdates
fast-urifrom 3.1.7 to 3.1.8Release notes
Sourced from fast-uri's releases.
Commits
ead3ab7Bumped v3.1.8c88b59efix: normalize decoded reg-name caseUpdates
proxy-addrfrom 2.0.7 to 2.0.8Release notes
Sourced from proxy-addr's releases.
Changelog
Sourced from proxy-addr's changelog.
Commits
a11ad822.0.8 (#70)780911dfix: reject IPv4 trust via mapped IPv6 subnets with a short prefix92e103efix(ci): use publised as release trigger event (#71)3e5ac75ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)4b9db81chore(ci): npm-publish via workflows (#54)655e895build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)50ce4d0build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)0fd347fbuild(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)6a517fabuild(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)0d45e2aFix "arugment" typo in README (#61)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.
Updates
brace-expansionfrom 1.1.13 to 1.1.21Commits
8e81e181.1.21ffdfa3eMerge commit from forkc6513ad1.1.201efee7cMerge commit from forka34340a1.1.190bcbfc0Merge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.