Skip to content

chore(deps): Bump the production-dependencies group across 1 directory with 11 updates #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): Bump the production-dependencies group across 1 directory with 11 updates #144

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 26, 2026 •
edited
Loading

Bumps the production-dependencies group with 9 updates in the / directory:

Package From To
@modelcontextprotocol/sdk 1.22.0 1.25.3
body-parser 2.2.0 2.2.2
cors 2.8.5 2.8.6
express 5.1.0 5.2.1
finalhandler 2.1.0 2.1.1
send 1.2.0 1.2.1
serve-static 2.2.0 2.2.1
zod 3.25.76 4.3.6
zod-to-json-schema 3.25.0 3.25.1

Updates @modelcontextprotocol/sdk from 1.22.0 to 1.25.3

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.25.3

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.2...v1.25.3

v1.25.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.1...v1.25.2

1.25.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.0...1.25.1

1.25.0

What's Changed

... (truncated)

Commits
  • ced7535 1.25.3
  • 6e8f7e1 fix: prevent Hono from overriding global Response object (v1.x) (#1411)
  • 12ae856 [v1.x backport] Use correct schema for client sampling validation when tools ...
  • b392f02 fix: prevent ReDoS in UriTemplate regex patterns (v1.x backport) (#1365)
  • a0c9b13 fix: README badges links destinations (#907)
  • 6dd08ac ci: trigger workflow on v1.x branch (#1319)
  • 384311b chore: bump version for patch fix (#1307)
  • fb07af8 spec types - backwards compatibility changes (#1306)
  • 2b20ca9 chore: bump version for release (#1301)
  • 67ba7ad feat: fetch transport (#1209)
  • Additional commits viewable in compare view

Updates body-parser from 2.2.0 to 2.2.2

Release notes

Sourced from body-parser's releases.

v2.2.2

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.1...v2.2.2

v2.2.1

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3
Commits

Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates express from 5.1.0 to 5.2.1

Release notes

Sourced from express's releases.

v5.2.1

What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@v5.2.0...v5.2.1

v5.2.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

5.2.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

5.2.0 / 2025-12-01

  • Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • deps: body-parser@^2.2.1
  • A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.
Commits

Updates finalhandler from 2.1.0 to 2.1.1

Release notes

Sourced from finalhandler's releases.

v2.1.1

What's Changed

New Contributors

Full Changelog: pillarjs/finalhandler@v2.1.0...v2.1.1

Changelog

Sourced from finalhandler's changelog.

unreleased

  • deps:
    • debug@^4.4.3
    • statuses@^2.0.2

v2.1.1. / 2025-12-01

  • update engines field in the package.json to reflect the current compatibility (Node <18). See: 2.0.0
  • Minor changes (package metadata)
Commits
  • aa2851f 2.1.1 (#120)
  • e1ec820 fix: update engines reference in the pkg (#119)
  • 3fb91d2 build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 (#123)
  • 7f35d34 build(deps): bump github/codeql-action from 4.31.2 to 4.31.5
  • 15c096f build(deps): bump actions/checkout from 5.0.0 to 6.0.0
  • 0919cb8 build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 (#114)
  • 6be5f9c build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#115)
  • c33618a build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 (#116)
  • fbf0e17 build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (#117)
  • 27c3f30 build(deps): bump github/codeql-action from 3.29.11 to 3.30.5
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for finalhandler since your current version.


Updates iconv-lite from 0.6.3 to 0.7.2

Release notes

Sourced from iconv-lite's releases.

v0.7.2

🐞 Bug fixes

  • Correction of CommonJS exports in TypeScript definitions - by @​plbstl in #366

    Fixed the TypeScript definitions to correctly represent the CommonJS exports of the library. This resolves issues where consumers using TypeScript would encounter errors due to incorrect type definitions that did not align with the actual module exports.

Other changes

@dependabot
chore(deps): Bump the production-dependencies group across 1 director…
2aac72d 
…y with 11 updates

Bumps the production-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.22.0` | `1.25.3` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.2.2` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [express](https://github.com/expressjs/express) | `5.1.0` | `5.2.1` |
| [finalhandler](https://github.com/pillarjs/finalhandler) | `2.1.0` | `2.1.1` |
| [send](https://github.com/pillarjs/send) | `1.2.0` | `1.2.1` |
| [serve-static](https://github.com/expressjs/serve-static) | `2.2.0` | `2.2.1` |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.3.6` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.0` | `3.25.1` |



Updates `@modelcontextprotocol/sdk` from 1.22.0 to 1.25.3
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.22.0...v1.25.3)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `express` from 5.1.0 to 5.2.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.1.0...v5.2.1)

Updates `finalhandler` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/pillarjs/finalhandler/releases)
- [Changelog](https://github.com/pillarjs/finalhandler/blob/master/HISTORY.md)
- [Commits](pillarjs/finalhandler@v2.1.0...v2.1.1)

Updates `iconv-lite` from 0.6.3 to 0.7.2
- [Release notes](https://github.com/pillarjs/iconv-lite/releases)
- [Changelog](https://github.com/pillarjs/iconv-lite/blob/master/Changelog.md)
- [Commits](pillarjs/iconv-lite@v0.6.3...v0.7.2)

Updates `qs` from 6.14.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.14.1)

Updates `send` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@1.2.0...1.2.1)

Updates `serve-static` from 2.2.0 to 2.2.1
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v2.2.0...v2.2.1)

Updates `zod` from 3.25.76 to 4.3.6
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.3.6)

Updates `zod-to-json-schema` from 3.25.0 to 3.25.1
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.25.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: finalhandler
  dependency-version: 2.1.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: iconv-lite
  dependency-version: 0.7.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: send
  dependency-version: 1.2.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: serve-static
  dependency-version: 2.2.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.3.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 26, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants