Skip to content

build(deps): bump @modelcontextprotocol/sdk and agents - #34

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-27039aa8b1
Open

build(deps): bump @modelcontextprotocol/sdk and agents#34
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-27039aa8b1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown

Bumps @modelcontextprotocol/sdk to 1.32.1 and updates ancestor dependency agents. These dependencies need to be updated together.

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates agents from 0.19.0 to 0.28.1

Release notes

Sourced from agents's releases.

agents@0.28.1

Patch Changes

  • #2571 1bd2bc5 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

  • #2572 b7c6ab9 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

  • #2573 80719a5 Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

  • #2568 46570f5 Thanks @​mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

agents@0.28.0

This release adds two new tools, browser via agents/browser/{pi,ai-sdk,tanstack-ai} allowing an agent to create and manipulate a persistent browser session and web_fetch via agents/webfetch/{pi,ai-sdk,tanstack-ai} that can retrieve most document formats converted into markdown.

Minor Changes

Patch Changes

agents@0.27.0

This release adds four new experimental harnesses and a web_search tool, and reorganizes the experimental Channels API.

  • New experimental harnesses: AiSdkHarness, ThinkHarness, ContainerHarness (which runs Claude Code or Codex in a Container) and OpenCodeHarness, all with the same shape as PiHarness.
  • New agents/websearch: a web_search tool over Cloudflare's Web Search API for pi, the AI SDK and TanStack AI.
  • Channels moved to agents/experimental/channels: Channels is being rebuilt around conversations and turns, and the old agents/channels entry point has been removed. The new API includes ChannelGateway, the Web Channel and its client, an AI SDK chat transport, and a new npx agents tui terminal client.
  • Fixes: Streams, Tasks, useAgentChat reconnects, WebChannelClient, MCP credential cleanup on removeServer(), and x402 with MCP SDK v2.

Minor Changes

  • #2434 0ebeae5 Thanks @​cjol! - Add AiSdkHarness from the new agents/harness/ai-sdk entry point, which runs each message with streamText and keeps sessions and transcripts in the Durable Object, so Channels.forHarness can serve an AI SDK model. The same entry point exports the AI SDK message conversions it is built on and createSendMessageTool, an AI SDK tool that sends a message to a surface through the gateway.

  • #2431 6393265 Thanks @​cjol! - Add Channels to agents/experimental/channels: a Lifecycle capability that serves an agent harness's sessions as conversations to every surface that joins them, with durable, resumable responses on Streams. Connect a harness with Channels.forHarness(harness, { channels }). The entry point also exports the turn protocol types and a draft harness interface (AgentHarness), which may change.

  • #2429 df4cbd6 Thanks @​cjol! - Breaking: remove the first pass of agents/channels and move Channels to agents/experimental/channels.

    The agents/channels entry points are gone, along with ChannelHost, the fallback and fanout composites, and the AI SDK, TanStack AI and Voice helpers from the first pass. Slack, Telegram and Email move to agents/experimental/channels/slack, agents/experimental/channels/telegram and agents/experimental/channels/email, and keep verified ingress and normalization. Channels is being rebuilt around conversations and turns; the new API is experimental and may change between releases.

  • #2432 752cdc3 Thanks @​cjol! - Add ChannelGateway to agents/experimental/channels: the Worker entry point that verifies channel webhooks, takes Web Channel upgrades through web() from agents/experimental/channels/web, routes each to the agent object that holds its conversation, and delivers outbound messages. Every Channel that takes ingress needs a participant callback, where the application says who the sender is; Channels never picks an identity. The agent object is the authorization boundary: by default each participant gets one of their own, and a route callback can share one between participants or refuse them.

... (truncated)

Changelog

Sourced from agents's changelog.

0.28.1

Patch Changes

  • #2571 1bd2bc5 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

  • #2572 b7c6ab9 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

  • #2573 80719a5 Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

  • #2574 131af4b Thanks @​mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

  • #2568 46570f5 Thanks @​mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

0.28.0

Minor Changes

Patch Changes

0.27.0

This release adds four new experimental harnesses and a web_search tool, and reorganizes the experimental Channels API.

  • New experimental harnesses: AiSdkHarness, ThinkHarness, ContainerHarness (which runs Claude Code or Codex in a Container) and OpenCodeHarness, all with the same shape as PiHarness.
  • New agents/websearch: a web_search tool over Cloudflare's Web Search API for pi, the AI SDK and TanStack AI.
  • Channels moved to agents/experimental/channels: Channels is being rebuilt around conversations and turns, and the old agents/channels entry point has been removed. The new API includes ChannelGateway, the Web Channel and its client, an AI SDK chat transport, and a new npx agents tui terminal client.
  • Fixes: Streams, Tasks, useAgentChat reconnects, WebChannelClient, MCP credential cleanup on removeServer(), and x402 with MCP SDK v2.

Minor Changes

  • #2434 0ebeae5 Thanks @​cjol! - Add AiSdkHarness from the new agents/harness/ai-sdk entry point, which runs each message with streamText and keeps sessions and transcripts in the Durable Object, so Channels.forHarness can serve an AI SDK model. The same entry point exports the AI SDK message conversions it is built on and createSendMessageTool, an AI SDK tool that sends a message to a surface through the gateway.

  • #2431 6393265 Thanks @​cjol! - Add Channels to agents/experimental/channels: a Lifecycle capability that serves an agent harness's sessions as conversations to every surface that joins them, with durable, resumable responses on Streams. Connect a harness with Channels.forHarness(harness, { channels }). The entry point also exports the turn protocol types and a draft harness interface (AgentHarness), which may change.

  • #2429 df4cbd6 Thanks @​cjol! - Breaking: remove the first pass of agents/channels and move Channels to agents/experimental/channels.

    The agents/channels entry points are gone, along with ChannelHost, the fallback and fanout composites, and the AI SDK, TanStack AI and Voice helpers from the first pass. Slack, Telegram and Email move to agents/experimental/channels/slack, agents/experimental/channels/telegram and agents/experimental/channels/email, and keep verified ingress and normalization. Channels is being rebuilt around conversations and turns; the new API is experimental and may change between releases.

  • #2432 752cdc3 Thanks @​cjol! - Add ChannelGateway to agents/experimental/channels: the Worker entry point that verifies channel webhooks, takes Web Channel upgrades through web() from agents/experimental/channels/web, routes each to the agent object that holds its conversation, and delivers outbound messages. Every Channel that takes ingress needs a participant callback, where the application says who the sender is; Channels never picks an identity. The agent object is the authorization boundary: by default each participant gets one of their own, and a route callback can share one between participants or refuse them.

... (truncated)

Commits
  • b1e3614 Version Packages (#2570)
  • b7c6ab9 feat(agents): AI Gateway dynamic routes in createAI (#2572)
  • 131af4b chore(mcp): update MCP packages to 2.3.1 / SDK 1.32.1 and conformance to alph...
  • 46570f5 feat(agents): OpenCodeHarness session events, and Workspace tools in the exam...
  • 1bd2bc5 feat(agents): zdr and vendorKey options for createAI (#2571)
  • 80719a5 chore(mcp): update MCP client and server to 2.2.0 and SDK to 1.31.0 (#2573)
  • 48d9c36 Release agents@0.28.0 & @​cloudflare/think@​0.20.2 (#2537)
  • b65956e refactor(agents): keep ThinkHarness records in the shared harness store (#2540)
  • 6614955 chore(agents): mark Lifecycle, Scheduler, State, WebSockets and MCPClientMana...
  • c1e71b3 feat(agents): add web_fetch tool (#2520)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump @modelcontextprotocol/sdk and agents
5c5605e 
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) to 1.32.1 and updates ancestor dependency [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents). These dependencies need to be updated together.


Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.32.1)

Updates `agents` from 0.19.0 to 0.28.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.28.1/packages/agents)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: indirect
- dependency-name: agents
  dependency-version: 0.28.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants