build(deps): bump the web-dependencies group in /clients/web with 18 updates

[dependabot]

Bumps the web-dependencies group in /clients/web with 18 updates:

Package	From	To
@dnd-kit/sortable	8.0.0	10.0.0
@mantine/core	8.3.18	9.5.1
@mantine/form	8.3.18	9.5.1
@mantine/hooks	8.3.18	9.5.1
@mantine/notifications	8.3.18	9.5.1
@modelcontextprotocol/client	2.0.0-beta.5	2.0.0
@modelcontextprotocol/core	2.0.0-beta.5	2.0.0
@modelcontextprotocol/server	2.0.0-beta.5	2.0.0
chokidar	4.0.3	5.0.0
commander	13.1.0	15.0.0
open	10.2.0	11.0.0
pino	9.14.0	10.3.1
zod	4.3.6	4.4.3
@testing-library/jest-dom	6.9.1	7.0.0
@types/node	24.13.3	26.1.2
globals	17.8.0	17.9.0
prettier	3.8.4	3.9.6
typescript	5.9.3	7.0.2

Updates @dnd-kit/sortable from 8.0.0 to 10.0.0

Changelog

Sourced from @​dnd-kit/sortable's changelog.

10.0.0

Patch Changes

• Updated dependencies [0c6a28d]:
  • @​dnd-kit/core@​6.3.0

9.0.0

Patch Changes

• #1542 f629ec6 Thanks @​clauderic! - Fix bug with draggable and sortable elements with an id equal to 0.

• Updated dependencies [00ec286, 995dc23, f629ec6, 99643f6, 6bbe39b, 545a41c, bcaf7c4]:

  • @​dnd-kit/core@​6.2.0

Commits

• 060c982 Version Packages
• 2eedcc3 Version Packages
• f629ec6 Fix for when id is equal to 0
• See full diff in compare view

Updates @mantine/core from 8.3.18 to 9.5.1

Release notes

Sourced from @​mantine/core's releases.

9.5.0 🤖

View changelog with demos on mantine.dev website

Support Mantine development

You can now sponsor Mantine development with OpenCollective. All funds are used to improve Mantine and create new features and components.

Migration to oxc

Mantine has migrated its linting and formatting toolchain from ESLint and Prettier to oxc – oxlint is now used as the linter and oxfmt as the formatter. Both tools are written in Rust and are significantly faster than their predecessors, which makes linting and formatting the entire codebase almost instant.

The shared configuration is available as a new oxc-config-mantine package (a replacement for the previous eslint-config-mantine). You can use it in your own projects to follow the same code style and conventions as Mantine.

Native level select in date pickers

DatePicker and all other date picker components (DatePickerInput, MonthPicker, YearPicker, DateTimePicker, etc.) now support the withNativeLevelSelect prop. When enabled, it replaces the calendar header level button with native <select> elements, making it easy to quickly navigate to a specific month and year.

import { DatePicker } from '@mantine/dates';
function Demo() {
return <DatePicker withNativeLevelSelect yearsSelectRange={[2020, 2035]} />;
}

Timeline opposite and alternate content

Timeline Timeline.Item component now supports the opposite prop that allows rendering content on the opposite side of the timeline. When any item has the opposite prop, the timeline switches to a centered layout with content on both sides of the line.

import { Timeline, Text } from '@mantine/core';
import { GitBranchIcon, GitCommitIcon, GitPullRequestIcon, ChatCircleDotsIcon } from '@phosphor-icons/react';
function Demo() {
return (
<Timeline active={1} bulletSize={24} lineWidth={2}>
<Timeline.Item
</tr></table>

... (truncated)

Commits

• 0f57eaf [release] Version: 9.5.1
• 58abe86 [@​mantine/core] ColorInput: Add support for fullWidth prop (#9061)
• 34db05f Merge branch 'master' of github.com:mantinedev/mantine
• 1d16750 [@​mantine/core] Checkbox: Fix incottect indeterminate aria attributes handlin...
• 4e6fd21 [@​mantine/core] FloatingIndicator: Fix position and size calculation under sc...
• 1d59dab [@​mantine/core] Tooltip: Add interactive prop support (#9072)
• 4eae6a4 [@​mantine/core] Cascader: Add safe area polygon support
• f5119ac [@​mantine/core] PasswordInput: Add option to change whether the visibility to...
• ca9bc6f [release] Version: 9.5.1-alpha.1
• 8f1ad1b [release] Version: 9.5.1-alpha.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​mantine/core since your current version.

Updates @mantine/form from 8.3.18 to 9.5.1

Release notes

Sourced from @​mantine/form's releases.

9.5.0 🤖

View changelog with demos on mantine.dev website

Support Mantine development

You can now sponsor Mantine development with OpenCollective. All funds are used to improve Mantine and create new features and components.

Migration to oxc

Mantine has migrated its linting and formatting toolchain from ESLint and Prettier to oxc – oxlint is now used as the linter and oxfmt as the formatter. Both tools are written in Rust and are significantly faster than their predecessors, which makes linting and formatting the entire codebase almost instant.

The shared configuration is available as a new oxc-config-mantine package (a replacement for the previous eslint-config-mantine). You can use it in your own projects to follow the same code style and conventions as Mantine.

Native level select in date pickers

DatePicker and all other date picker components (DatePickerInput, MonthPicker, YearPicker, DateTimePicker, etc.) now support the withNativeLevelSelect prop. When enabled, it replaces the calendar header level button with native <select> elements, making it easy to quickly navigate to a specific month and year.

import { DatePicker } from '@mantine/dates';
function Demo() {
return <DatePicker withNativeLevelSelect yearsSelectRange={[2020, 2035]} />;
}

Timeline opposite and alternate content

Timeline Timeline.Item component now supports the opposite prop that allows rendering content on the opposite side of the timeline. When any item has the opposite prop, the timeline switches to a centered layout with content on both sides of the line.

import { Timeline, Text } from '@mantine/core';
import { GitBranchIcon, GitCommitIcon, GitPullRequestIcon, ChatCircleDotsIcon } from '@phosphor-icons/react';
function Demo() {
return (
<Timeline active={1} bulletSize={24} lineWidth={2}>
<Timeline.Item
</tr></table>

... (truncated)

Commits

• 0f57eaf [release] Version: 9.5.1
• ca9bc6f [release] Version: 9.5.1-alpha.1
• 8f1ad1b [release] Version: 9.5.1-alpha.0
• f1d3306 [release] Version: 9.5.0
• 7320562 [release] Version: 9.4.3
• de21a82 [release] Version: 9.4.3-alpha.0
• e5752de [release] Version: 9.4.2
• 1d68be7 [@​mantine/form] Fix async validation with debounce on initial keystroke of em...
• d709e0b [release] Version: 9.4.1
• f53d726 [@​mantine/form] Fix some functions not working correctly with react compiler ...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​mantine/form since your current version.

Updates @mantine/hooks from 8.3.18 to 9.5.1

Release notes

Sourced from @​mantine/hooks's releases.

9.5.0 🤖

View changelog with demos on mantine.dev website

Support Mantine development

You can now sponsor Mantine development with OpenCollective. All funds are used to improve Mantine and create new features and components.

Migration to oxc

Mantine has migrated its linting and formatting toolchain from ESLint and Prettier to oxc – oxlint is now used as the linter and oxfmt as the formatter. Both tools are written in Rust and are significantly faster than their predecessors, which makes linting and formatting the entire codebase almost instant.

The shared configuration is available as a new oxc-config-mantine package (a replacement for the previous eslint-config-mantine). You can use it in your own projects to follow the same code style and conventions as Mantine.

Native level select in date pickers

DatePicker and all other date picker components (DatePickerInput, MonthPicker, YearPicker, DateTimePicker, etc.) now support the withNativeLevelSelect prop. When enabled, it replaces the calendar header level button with native <select> elements, making it easy to quickly navigate to a specific month and year.

import { DatePicker } from '@mantine/dates';
function Demo() {
return <DatePicker withNativeLevelSelect yearsSelectRange={[2020, 2035]} />;
}

Timeline opposite and alternate content

Timeline Timeline.Item component now supports the opposite prop that allows rendering content on the opposite side of the timeline. When any item has the opposite prop, the timeline switches to a centered layout with content on both sides of the line.

import { Timeline, Text } from '@mantine/core';
import { GitBranchIcon, GitCommitIcon, GitPullRequestIcon, ChatCircleDotsIcon } from '@phosphor-icons/react';
function Demo() {
return (
<Timeline active={1} bulletSize={24} lineWidth={2}>
<Timeline.Item
</tr></table>

... (truncated)

Commits

• 0f57eaf [release] Version: 9.5.1
• ce00cdd [@​mantine/hooks] use-scroll-spy: Allow usage with refs (#9025)
• ca9bc6f [release] Version: 9.5.1-alpha.1
• 8f1ad1b [release] Version: 9.5.1-alpha.0
• 953192e [@​mantine/core] FloatingWindow: Add support for onSizeChange and `onResize...
• f1d3306 [release] Version: 9.5.0
• 7320562 [release] Version: 9.4.3
• de21a82 [release] Version: 9.4.3-alpha.0
• e5752de [release] Version: 9.4.2
• 714b17e [@​mantine/hooks] Fix unstable scrollIntoView for some bundlers (#9035)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​mantine/hooks since your current version.

Updates @mantine/notifications from 8.3.18 to 9.5.1

Release notes

Sourced from @​mantine/notifications's releases.

9.5.0 🤖

View changelog with demos on mantine.dev website

Support Mantine development

You can now sponsor Mantine development with OpenCollective. All funds are used to improve Mantine and create new features and components.

Migration to oxc

Mantine has migrated its linting and formatting toolchain from ESLint and Prettier to oxc – oxlint is now used as the linter and oxfmt as the formatter. Both tools are written in Rust and are significantly faster than their predecessors, which makes linting and formatting the entire codebase almost instant.

The shared configuration is available as a new oxc-config-mantine package (a replacement for the previous eslint-config-mantine). You can use it in your own projects to follow the same code style and conventions as Mantine.

Native level select in date pickers

DatePicker and all other date picker components (DatePickerInput, MonthPicker, YearPicker, DateTimePicker, etc.) now support the withNativeLevelSelect prop. When enabled, it replaces the calendar header level button with native <select> elements, making it easy to quickly navigate to a specific month and year.

import { DatePicker } from '@mantine/dates';
function Demo() {
return <DatePicker withNativeLevelSelect yearsSelectRange={[2020, 2035]} />;
}

Timeline opposite and alternate content

Timeline Timeline.Item component now supports the opposite prop that allows rendering content on the opposite side of the timeline. When any item has the opposite prop, the timeline switches to a centered layout with content on both sides of the line.

import { Timeline, Text } from '@mantine/core';
import { GitBranchIcon, GitCommitIcon, GitPullRequestIcon, ChatCircleDotsIcon } from '@phosphor-icons/react';
function Demo() {
return (
<Timeline active={1} bulletSize={24} lineWidth={2}>
<Timeline.Item
</tr></table>

... (truncated)

Commits

• 0f57eaf [release] Version: 9.5.1
• ca9bc6f [release] Version: 9.5.1-alpha.1
• 8f1ad1b [release] Version: 9.5.1-alpha.0
• f1d3306 [release] Version: 9.5.0
• 7320562 [release] Version: 9.4.3
• de21a82 [release] Version: 9.4.3-alpha.0
• e5752de [release] Version: 9.4.2
• 6312c97 [@​mantine/notifications] NotificationContainer: Fix autoClose leak (#9048)
• d709e0b [release] Version: 9.4.1
• 75d5ab5 [release] Version: 9.4.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​mantine/notifications since your current version.

Updates @modelcontextprotocol/client from 2.0.0-beta.5 to 2.0.0

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.0.0

Minor Changes

• #2501 1480241 Thanks @​felixweinberger! - Export the Protocol base class and mergeCapabilities from the @modelcontextprotocol/client and @modelcontextprotocol/server package roots, restoring the v1 import for consumers that subclass Protocol (e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.

  The codemod now rewrites Protocol and mergeCapabilities imports from shared/protocol.js to the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.

• #2511 f60dff0 Thanks @​felixweinberger! - ConnectOptions.prior accepts a cached era verdict — the new exported type PriorDiscovery. { kind: 'modern', discover } adopts a previously obtained DiscoverResult with zero round trips; { kind: 'legacy' } skips the server/discover probe and runs the plain initialize handshake directly, for servers known out-of-band to be legacy — without pinning the client to mode: 'legacy': stop supplying the verdict and connect() falls back to the configured versionNegotiation mode (under 'auto', it re-probes and rediscovers an upgraded server). Freshness is the supplying host's responsibility — a stale legacy verdict succeeds silently against an upgraded server, so hosts must date cached legacy verdicts in their own storage and stop supplying them past their policy horizon. Persisted-blob plumbing is hardened: prior: null is treated as absent, the modern arm's discover payload is schema-validated before any connection state changes, and an unrecognized shape rejects with a typed SdkError(EraNegotiationFailed) instead of a TypeError.

• #2468 5db6e38 Thanks @​felixweinberger! - The response cache now stores results as JSON-serialized documents (serialize on write, parse on read) instead of live object graphs isolated with structuredClone. Same mutation isolation, but no dependency on the structuredClone global — whose absence (jest+jsdom, Node < 17) previously made every cache write throw into the store-error swallow, silently disabling caching and output-schema lookups for the session. A value without a JSON representation now fails the write loudly to the error sink, and an undecodable document in an external store is reported, dropped, and read as a miss.

  Migration for custom ResponseCacheStore implementations: CacheEntry.value (and the set() entry value) is now string — persist and return it verbatim, JSON.parse to inspect. Entries persisted by a previous SDK version fail decode once (reported, dropped) and are rewritten on the next fetch.

• #2477 8e1d2e9 Thanks @​felixweinberger! - Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

• #2513 f413763 Thanks @​felixweinberger! - Align the 2026-07-28 wire with the final revision (spec PR #3002): serverInfo moves from the DiscoverResult body to the result _meta, and the per-request envelope's clientInfo demotes from required to SHOULD.

  Before this change the SDK shipped the pre-#3002 shape in both directions: the client hard-rejected a conforming server's DiscoverResult (missing body serverInfo failed parse, so the probe misclassified the server as legacy and attempted an initialize handshake against it — a hard connect failure against a modern-only server such as go-sdk v1.7.0-pre.3), and the server rejected conforming clients that omit clientInfo.

  Now:

  • The 2026 wire schemas are the final revision exactly: no body serverInfo on DiscoverResult, envelope clientInfo optional (a present-but-malformed value still fails validation).
  • Servers stamp _meta['io.modelcontextprotocol/serverInfo'] on every 2026-era response (spec SHOULD; a handler-authored value wins, the 2025-era wire is untouched). This includes the entry-built subscriptions/listen graceful-close results — the spec's SubscriptionsListenResultMeta extends ResultMetaObject.
  • Clients keep sending clientInfo and read server identity from the discover result's _meta only. A server that stamps no identity is anonymous: getServerVersion() is undefined and the response cache partitions under a per-connection surrogate. A malformed _meta serverInfo value is treated as absent on receive (the spec marks the field self-reported, unverified, and display-only).
  • Breaking type changes: DiscoverResult no longer declares serverInfo; RequestMetaEnvelope's clientInfo is optional. New public constant SERVER_INFO_META_KEY ('io.modelcontextprotocol/serverInfo').

• #2483 3f07a32 Thanks @​felixweinberger! - Add preloadSchemas(), an explicit opt-in to eager wire-schema construction, and call it automatically in the Cloudflare Workers builds. The wire schemas are built lazily by default, which is the right trade on process-per-invocation runtimes — but on isolate platforms that bill request CPU while module evaluation runs during isolate warm-up, laziness moves construction into the first request each fresh isolate serves. Calling preloadSchemas() at module scope (it is synchronous and idempotent) moves that one-time cost back to module evaluation; the packages' workerd export condition now does this automatically, while the Node and browser builds stay lazy. The server package gains a dedicated browser shim for this (its browser condition previously reused the workerd shim), so browser bundles keep lazy construction.

Patch Changes

• #2402 a400259 Thanks @​felixweinberger! - First beta release of SDK v2 with support for the MCP 2026-07-28 specification revision. See the migration guides for upgrading from v1 (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision (docs/migration/support-2026-07-28.md).

• #2456 44797d7 Thanks @​felixweinberger! - Restore the v1 parse tolerance for CallToolResult.content: an inbound legacy-era tools/call result without content defaults to [] instead of failing validation. Deployed servers — accepted by SDK v1 for years — return structuredContent-only (or otherwise content-less) results, and the strict parse turned every such call into an INVALID_RESULT error before application code could run.

  The silent-empty-success hazard the strictness guarded is preserved where it matters: the 2025 era's wire-seam schema refuses to default content for a body carrying another result family's vocabulary (task, inputRequests, requestState — the era is frozen, so the list is complete), and the 2026-era wire schemas stay strict — modern-revision servers have no legacy excuse. Task interop through an explicit result schema is untouched (including bodies that also stamp a foreign resultType), and the server-side authoring normalization refuses the same foreign-family vocabulary.

  Server-side authoring is era-independent: a handler result without content (dynamic/JS callers — the TypeScript surface requires it) is normalized to content: [] before era validation on every leg, reaching the wire spec-valid.

  Conscious call: the nested sampling ToolResultContentSchema stays spec-strict — v1 had defaulted its content too, but it is params-side (tool results a caller authors into a sampling message), deliberately not restored.

• #2431 1b90c96 Thanks @​morluto! - Fix the CommonJS validators/ajv subpath so reading the exported Ajv class no longer throws ReferenceError: import_ajv is not defined. The subpath now re-exports the bundled provider's concrete Ajv value in CJS output, matching the existing ESM behavior.

• #2405 f172626 Thanks @​mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map adds a require condition so require('@modelcontextprotocol/…') works from CommonJS consumers. Output extensions are normalized across all packages (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the public import paths are unchanged.

... (truncated)

Commits

• cc4b416 Version Packages (#2555)
• faa7e2b fix(client): treat HTTP 401/403 on the negotiation probe as auth failures, no...
• a9835b4 docs: comprehensive GA pass — stable-release wording, released-spec links, in...
• f6fbd48 chore: exit changesets prerelease mode (#2565)
• f130e1a fix(validators): honor declared draft-07/06 JSON Schema dialects instead of r...
• 6dac272 test: bump conformance referee to 0.2.0-alpha.10, unbaseline server-stateless...
• 470678d fix: send SSE keep-alive comment frames from WebStandardStreamableHTTPServerT...
• See full diff in compare view

Updates @modelcontextprotocol/core from 2.0.0-beta.5 to 2.0.0

Release notes

Sourced from @​modelcontextprotocol/core's releases.

@​modelcontextprotocol/core@​2.0.0

Minor Changes

• #2477 8e1d2e9 Thanks @​felixweinberger! - Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

• #2513 f413763 Thanks @​felixweinberger! - Align the 2026-07-28 wire with the final revision (spec PR #3002): serverInfo moves from the DiscoverResult body to the result _meta, and the per-request envelope's clientInfo demotes from required to SHOULD.

  Before this change the SDK shipped the pre-#3002 shape in both directions: the client hard-rejected a conforming server's DiscoverResult (missing body serverInfo failed parse, so the probe misclassified the server as legacy and attempted an initialize handshake against it — a hard connect failure against a modern-only server such as go-sdk v1.7.0-pre.3), and the server rejected conforming clients that omit clientInfo.

  Now:

  • The 2026 wire schemas are the final revision exactly: no body serverInfo on DiscoverResult, envelope clientInfo optional (a present-but-malformed value still fails validation).
  • Servers stamp _meta['io.modelcontextprotocol/serverInfo'] on every 2026-era response (spec SHOULD; a handler-authored value wins, the 2025-era wire is untouched). This includes the entry-built subscriptions/listen graceful-close results — the spec's SubscriptionsListenResultMeta extends ResultMetaObject.
  • Clients keep sending clientInfo and read server identity from the discover result's _meta only. A server that stamps no identity is anonymous: getServerVersion() is undefined and the response cache partitions under a per-connection surrogate. A malformed _meta serverInfo value is treated as absent on receive (the spec marks the field self-reported, unverified, and display-only).
  • Breaking type changes: DiscoverResult no longer declares serverInfo; RequestMetaEnvelope's clientInfo is optional. New public constant SERVER_INFO_META_KEY ('io.modelcontextprotocol/serverInfo').

Patch Changes

• #2402 a400259 Thanks @​felixweinberger! - First beta release of SDK v2 with support for the MCP 2026-07-28 specification revision. See the migration guides for upgrading from v1 (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision (docs/migration/support-2026-07-28.md).

• #2456 44797d7 Thanks @​felixweinberger! - Restore the v1 parse tolerance for CallToolResult.content: an inbound legacy-era tools/call result without content defaults to [] instead of failing validation. Deployed servers — accepted by SDK v1 for years — return structuredContent-only (or otherwise content-less) results, and the strict parse turned every such call into an INVALID_RESULT error before application code could run.

  The silent-empty-success hazard the strictness guarded is preserved where it matters: the 2025 era's wire-seam schema refuses to default content for a body carrying another result family's vocabulary (task, inputRequests, requestState — the era is frozen, so the list is complete), and the 2026-era wire schemas stay strict — modern-revision servers have no legacy excuse. Task interop through an explicit result schema is untouched (including bodies that also stamp a foreign resultType), and the server-side authoring normalization refuses the same foreign-family vocabulary.

  Server-side authoring is era-independent: a handler result without content (dynamic/JS callers — the TypeScript surface requires it) is normalized to content: [] before era validation on every leg, reaching the wire spec-valid.

  Conscious call: the nested sampling ToolResultContentSchema stays spec-strict — v1 had defaulted its content too, but it is params-side (tool results a caller authors into a sampling message), deliberately not restored.

• #2405 f172626 Thanks @​mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map adds a require condition so require('@modelcontextprotocol/…') works from CommonJS consumers. Output extensions are normalized across all packages (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the public import paths are unchanged.

Commits

• cc4b416 Version Packages (#2555)
• faa7e2b fix(client): treat HTTP 401/403 on the negotiation probe as auth failures, no...
• a9835b4 docs: comprehensive GA pass — stable-release wording, released-spec links, in...
• f6fbd48 chore: exit changesets prerelease mode (#2565)
• f130e1a fix(validators): honor declared draft-07/06 JSON Schema dialects instead of r...
• 6dac272 test: bump conformance referee to 0.2.0-alpha.10, unbaseline server-stateless...
• 470678d fix: send SSE keep-alive comment frames from WebStandardStreamableHTTPServerT...
• See full diff in compare view

Updates @modelcontextprotocol/server from 2.0.0-beta.5 to 2.0.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.0.0

Minor Changes

• #2477 8e1d2e9 Thanks @​felixweinberger! - Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

Patch Changes

• #2402 a400259 Thanks @​felixweinberger! - First beta release of SDK v2 with support for the MCP 2026-07-28 specification revision. See the migration guides for upgrading from v1 (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision (docs/migration/support-2026-07-28.md).

• #2405 f172626 Thanks @​mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map adds a require condition so require('@modelcontextprotocol/…') works from CommonJS consumers. Output extensions are normalized across all packages (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the public import paths are unchanged.

• #2476 e0a0ab7 Thanks @​felixweinberger! - Build protocol-revision wire schemas lazily on first validation instead of at import. Each revision's schema set is now constructed by a module-level memoized factory, so importing the client or server package no longer pays the construction cost of both frozen wire-schema graphs up front. Method membership in the revision registries stays static, the schemas themselves are unchanged, and registry lookups keep returning reference-identical schema objects.

• Updated dependencies [a400259, 44797d7, f172626, 8e1d2e9, f413763]:

  • @​modelcontextprotocol/core@​2.0.0

@​modelcontextprotocol/server@​2.0.0

Minor Changes

• #2501 1480241 Thanks @​felixweinberger! - Export the Protocol base class and mergeCapabilities from the @modelcontextprotocol/client and @modelcontextprotocol/server package roots, restoring the v1 import for consumers that subclass Protocol (e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.

  The codemod now rewrites Protocol and mergeCapabilities imports from shared/protocol.js to the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.

• #2477 8e1d2e9 Thanks @​felixweinberger! - Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

• #2513 f413763 Thanks @​felixweinberger! - Align the 2026-07-28 wire with the final revision (spec PR #3002): serverInfo moves from the DiscoverResult body to the result _meta, and the per-request envelope's clientInfo demotes from required to SHOULD.

  Before this change the SDK shipped the pre-#3002 shape in both directions: the client hard-rejected a conforming server's DiscoverResult (missing body serverInfo failed parse, so the probe misclassified the server as legacy and attempted an initialize handshake against it — a hard connect failure against a modern-only server such as go-sdk v1.7.0-pre.3), and the server rejected conforming clients that omit clientInfo.

  Now:

  • The 2026 wire schemas are the final revision exactly: no body serverInfo on DiscoverResult, envelope clientInfo optional (a present-but-malformed value still fails validation).
  • Servers stamp _meta['io.modelcontextprotocol/serverInfo'] on every 2026-era response (spec SHOULD; a handler-authored value wins, the 2025-era wire is untouched). This includes the entry-built subscriptions/listen graceful-close results — the spec's SubscriptionsListenResultMeta extends ResultMetaObject.
  • Clients keep sending clientInfo and read server identity from the discover result's _meta only. A server that stamps no identity is anonymous: getServerVersion() is undefined and the response cache partitions under a per-connection surrogate. A malformed _meta serverInfo value is treated as absent on receive (the spec marks the field self-reported, unverified, and display-only).
  • Breaking type changes: DiscoverResult no longer declares serverInfo; RequestMetaEnvelope's clientInfo is optional. New public constant SERVER_INFO_META_KEY ('io.modelcontextprotocol/serverInfo').

• #2369 24be404 Thanks @​mattzcarey! - Allow inputRequired.elicit() to accept a Standard Schema such as a Zod object for requestedSchema. The builder converts it to MCP's restricted form-elicitation JSON Schema, while the same schema can validate and type the response through acceptedContent() on handler re-entry. Zod formats mapping to email, uri, date, and date-time are supported. Shapes the restricted schema cannot express reject before anything is sent — nested objects, .regex() and customized zod format patterns, exclusive number bounds (.positive()/.gt()), literal unions (use z.enum or z.literal(['a', 'b'])), and non-spec root keywords like z.strictObject()'s additionalProperties.

• #2541 470678d Thanks @​mattzcarey! - Add configurable SSE keep-alive comment frames to Streamable HTTP transports and apply createMcpHandler's existing keepAliveMs option to every HTTP SSE stream it serves.

• #2420 7635115 Thanks @​felixweinberger! - Add runtime-neutral Bearer authentication to @modelcontextprotocol/server: requireBearerAuth gates web-standard fetch(request) hosts (Cloudflare Workers, Deno, Bun, Hono), built on the exported verifyBearerToken and

... (truncated)

Commits

• cc4b416 Version Packages (#2555)
• faa7e2b fix(client): treat HTTP 401/403 on the negotiation probe as auth failures, no...
• a9835b4 docs: comprehensive GA pass — stable-release wording, released-spec links, in...
• f6fbd48 chore: exit changesets prerelease mode (#2565)
• f130e1a fix(validators): honor declared draft-07/06 JSON Schema dialects instead of r...
• 6dac272 test: bump conformance referee to 0.2.0-alpha.10, unbaseline server-stateless...
• 470678d fix: send SSE keep-alive comment frames from WebStandardStreamableHTTPServerT...
• See full diff in compare view

Updates chokidar from 4.0.3 to 5.0.0

Release notes

Sourced from chokidar's releases.

5.0.0

• Make the package ESM-only. Reduces on-disk package size from ~150kb to ~80kb
• Increase minimum node.js version to v20.19. The versions starting from it support loading esm files from cjs
• fix: Make types more precise paulmillr/chokidar#1424
• perf: re-use double slash regex paulmillr/chokidar#1435
• Update readdirp to ESM-only v5
• Lots of minor improvements in tests
• Increase security of NPM releases. Switch to token-less Trusted Publishing, with help of jsbt
• Switch compilation mode to isolatedDeclaration-based typescript for simplified auto-generated docs

New Contributors

• @​mhkeller made their first contribution in paulmillr/chokidar#1426
• @​btea made their first contribution in paulmillr/chokidar#1432

Full ChangelogDescription has been truncated