René's URL Explorer Experiment

Title: chore(deps): update @ai-sdk/mcp to v2 - autoclosed by renovate[bot] · Pull Request #411 · deepnote/deepnote · GitHub

Open Graph Title: chore(deps): update @ai-sdk/mcp to v2 - autoclosed by renovate[bot] · Pull Request #411 · deepnote/deepnote

X Title: chore(deps): update @ai-sdk/mcp to v2 - autoclosed by renovate[bot] · Pull Request #411 · deepnote/deepnote

Description: This PR contains the following updates: Package Change Age Confidence @ai-sdk/mcp (source) ^1.0.70 → ^2.0.0 Release Notes vercel/ai (@​ai-sdk/mcp) v2.0.69 Compare Source Patch Changes Updated dependencies [d3bcad9] @​ai-sdk/provider@4.0.24 @​ai-sdk/provider-utils@5.0.56 v2.0.68 Compare Source Patch Changes Updated dependencies [fc1e19e] Updated dependencies [5094ebd] Updated dependencies [268225c] Updated dependencies [0af2f7c] @​ai-sdk/provider-utils@5.0.55 @​ai-sdk/provider@4.0.23 v2.0.67 Compare Source Patch Changes bba3927: feat(mcp): export MCPClientError for typed MCP failure handling 9384b92: fix(mcp): reject SSE startup when the connection closes before an endpoint is received 575383e: fix(mcp): preserve OAuth credentials when callback codes are rejected Updated dependencies [2959d35] Updated dependencies [59116e6] @​ai-sdk/provider@4.0.22 @​ai-sdk/provider-utils@5.0.54 v2.0.66 Compare Source Patch Changes 3ff0f54: feat(mcp): add AuthorizationServerMismatchError for OAuth authorization server pin mismatches v2.0.65 Compare Source Patch Changes 4d0500e: fix(mcp): identify failed OAuth tokens for conditional invalidation v2.0.64 Compare Source Patch Changes Updated dependencies [8c65988] Updated dependencies [527a163] @​ai-sdk/provider@4.0.21 @​ai-sdk/provider-utils@5.0.53 v2.0.63 Compare Source Patch Changes ede5b89: chore: migrate package builds from tsup to tsdown Updated dependencies [ede5b89] @​ai-sdk/provider@4.0.20 @​ai-sdk/provider-utils@5.0.52 v2.0.62 Compare Source Patch Changes 868c475: Preserve prototype-named tools, providers, and provider metadata as own properties without changing lookup object prototypes. Prevent inherited names from resolving as registered providers or causing image metadata aggregation to fail. Updated dependencies [c2511c1] @​ai-sdk/provider-utils@5.0.51 v2.0.61 Compare Source Patch Changes Updated dependencies [e3605f6] Updated dependencies [525efc5] @​ai-sdk/provider-utils@5.0.50 @​ai-sdk/provider@4.0.19 v2.0.60 Compare Source Patch Changes Updated dependencies [af9597b] Updated dependencies [bc49f78] @​ai-sdk/provider-utils@5.0.49 v2.0.58 Compare Source Patch Changes 1ffd453: fix(mcp): preserve explicit stdio transport environment values v2.0.57 Compare Source Patch Changes 771e74b: chore: enable dead code lint rules Updated dependencies [fe07867] Updated dependencies [a4b0940] Updated dependencies [771e74b] @​ai-sdk/provider-utils@5.0.47 v2.0.56 Compare Source Patch Changes Updated dependencies [ffb0e76] @​ai-sdk/provider@4.0.18 @​ai-sdk/provider-utils@5.0.46 v2.0.55 Compare Source Patch Changes 7fc2bc1: fix(mcp): preserve pre-registered OAuth clients after client authentication errors and require explicit provider provenance before replacing dynamically registered credentials v2.0.54 Compare Source Patch Changes Updated dependencies [2973485] Updated dependencies [a4db5ea] Updated dependencies [2937ea2] @​ai-sdk/provider-utils@5.0.45 v2.0.53 Compare Source Patch Changes 4b5cb49: fix(mcp): avoid duplicate legacy SSE OAuth refreshes for stale 401 responses Updated dependencies [0455398] @​ai-sdk/provider-utils@5.0.44 v2.0.52 Compare Source Patch Changes Updated dependencies [215b25e] Updated dependencies [d4d96bf] Updated dependencies [a7dd893] Updated dependencies [3456e2c] Updated dependencies [c4e76de] @​ai-sdk/provider-utils@5.0.43 @​ai-sdk/provider@4.0.17 v2.0.51 Compare Source Patch Changes df91a09: fix(mcp): use the stored authorization server for OAuth callbacks when protected resource metadata rediscovery fails 2cd80b3: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads. Updated dependencies [91c2128] Updated dependencies [2cd80b3] Updated dependencies [d06bb2a] Updated dependencies [123d71f] Updated dependencies [2fa5e0e] @​ai-sdk/provider-utils@5.0.42 @​ai-sdk/provider@4.0.16 v2.0.50 Compare Source Patch Changes Updated dependencies [5c0054d] Updated dependencies [39535af] @​ai-sdk/provider@4.0.15 @​ai-sdk/provider-utils@5.0.41 v2.0.49 Compare Source Patch Changes c43e4b7: fix(mcp): prevent SSRF in OAuth metadata discovery Updated dependencies [5ec21a6] Updated dependencies [7469a3b] Updated dependencies [813bb36] Updated dependencies [c43e4b7] @​ai-sdk/provider@4.0.14 @​ai-sdk/provider-utils@5.0.40 v2.0.48 Compare Source Patch Changes Updated dependencies [9942196] @​ai-sdk/provider@4.0.13 @​ai-sdk/provider-utils@5.0.39 v2.0.47 Compare Source Patch Changes Updated dependencies [912fb01] @​ai-sdk/provider@4.0.12 @​ai-sdk/provider-utils@5.0.38 v2.0.46 Compare Source Patch Changes Updated dependencies [a4ba394] Updated dependencies [45099da] Updated dependencies [9e1d1b2] Updated dependencies [a495511] @​ai-sdk/provider@4.0.11 @​ai-sdk/provider-utils@5.0.37 v2.0.45 Compare Source Patch Changes 33ba8fd: feat(mcp): surface server-provided tool annotations in tool metadata 3da84fd: Accept MCP tool results that return structuredContent without content by adding the serialized structured result as text. v2.0.44 Compare Source Patch Changes 809e922: fix(mcp): accept trailing slashes on origin-only OAuth issuers v2.0.43 Compare Source Patch Changes Updated dependencies [6bcc0f8] @​ai-sdk/provider-utils@5.0.36 v2.0.42 Compare Source Patch Changes Updated dependencies [5190b67] @​ai-sdk/provider@4.0.10 @​ai-sdk/provider-utils@5.0.35 v2.0.41 Compare Source Patch Changes Updated dependencies [aa45741] @​ai-sdk/provider@4.0.9 @​ai-sdk/provider-utils@5.0.34 v2.0.40 Compare Source Patch Changes Updated dependencies [90192f1] @​ai-sdk/provider-utils@5.0.33 v2.0.39 Compare Source Patch Changes Updated dependencies [3e125ba] @​ai-sdk/provider-utils@5.0.32 v2.0.37 Compare Source Patch Changes 1175434: Fetch all paginated tool definitions when creating an MCP tool set. Updated dependencies [591d25b] @​ai-sdk/provider@4.0.8 @​ai-sdk/provider-utils@5.0.30 v2.0.36 Compare Source Patch Changes b352a6a: fix(mcp): support spawning command shims such as npx on Windows Updated dependencies [b74971f] @​ai-sdk/provider-utils@5.0.29 v2.0.35 Patch Changes 76fb75d: fix(mcp): reject SSE requests when POST responses are unsuccessful v2.0.34 Patch Changes Updated dependencies [e6087c9] @​ai-sdk/provider-utils@5.0.28 v2.0.33 Patch Changes 1f29230: feat(mcp): harden oauth client registration according to latest protocol 0c60a40: feat(mcp): add mcp 2026 streamable HTTP support e6a9927: feat(mcp): add the latest 2026 protocol discovery foundation v2.0.32 Patch Changes 1011e33: Select MCP OAuth authorization scopes from WWW-Authenticate challenges or Protected Resource Metadata. v2.0.31 Patch Changes Updated dependencies [7fbfc6d] @​ai-sdk/provider-utils@5.0.27 v2.0.30 Compare Source Patch Changes Updated dependencies [401a4ba] @​ai-sdk/provider-utils@5.0.26 v2.0.29 Compare Source Patch Changes Updated dependencies [ad6a650] Updated dependencies [81cd026] @​ai-sdk/provider@4.0.7 @​ai-sdk/provider-utils@5.0.25 v2.0.28 Compare Source Patch Changes Updated dependencies [1937bef] @​ai-sdk/provider-utils@5.0.24 v2.0.27 Compare Source Patch Changes Updated dependencies [3469d0c] @​ai-sdk/provider@4.0.6 @​ai-sdk/provider-utils@5.0.23 v2.0.26 Compare Source Patch Changes Updated dependencies [2b60826] @​ai-sdk/provider-utils@5.0.22 v2.0.25 Compare Source Patch Changes Updated dependencies [1bec07d] @​ai-sdk/provider-utils@5.0.21 v2.0.24 Compare Source Patch Changes Updated dependencies [160ccdb] @​ai-sdk/provider-utils@5.0.20 v2.0.23 Compare Source Patch Changes Updated dependencies [79e133c] @​ai-sdk/provider@4.0.5 @​ai-sdk/provider-utils@5.0.19 v2.0.22 Compare Source Patch Changes Updated dependencies [5fc7da5] Updated dependencies [93b2acd] @​ai-sdk/provider-utils@5.0.18 v2.0.21 Compare Source Patch Changes Updated dependencies [fa95504] @​ai-sdk/provider-utils@5.0.17 v2.0.20 Compare Source Patch Changes 97f0565: Honor MCP request deadlines and support bounding or aborting client initialization. Updated dependencies [d8210b6] Updated dependencies [b192878] @​ai-sdk/provider-utils@5.0.16 v2.0.19 Compare Source Patch Changes Updated dependencies [1659cd5] Updated dependencies [6a5bdff] @​ai-sdk/provider-utils@5.0.15 v2.0.18 Compare Source Patch Changes Updated dependencies [0c464d9] Updated dependencies [c49380c] @​ai-sdk/provider-utils@5.0.14 v2.0.17 Compare Source Patch Changes Updated dependencies [1e2f324] @​ai-sdk/provider@4.0.4 @​ai-sdk/provider-utils@5.0.13 v2.0.16 Compare Source Patch Changes Updated dependencies [02ffdcb] Updated dependencies [76cb673] @​ai-sdk/provider-utils@5.0.12 v2.0.15 Compare Source Patch Changes d84ea43: fix(mcp): accept OAuth metadata without code challenge methods Updated dependencies [cd06458] @​ai-sdk/provider-utils@5.0.11 v2.0.14 Compare Source Patch Changes 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge: Runtime-validate _meta.ui and drop malformed or non-string fields. Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist. Derive a concrete postMessage target origin and validate inbound message origins. Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link. Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources. v2.0.13 Compare Source Patch Changes Updated dependencies [31c7be8] @​ai-sdk/provider-utils@5.0.10 v2.0.12 Compare Source Patch Changes Updated dependencies [4be62c1] Updated dependencies [7805e4a] Updated dependencies [cd12954] @​ai-sdk/provider-utils@5.0.9 v2.0.10 Compare Source Patch Changes Updated dependencies [0f93c57] @​ai-sdk/provider@4.0.3 @​ai-sdk/provider-utils@5.0.7 v2.0.9 Compare Source Patch Changes Updated dependencies [ac306ed] @​ai-sdk/provider-utils@5.0.6 v2.0.8 Compare Source Patch Changes 3e6e955: Reject in-flight MCP requests when their abort signal fires and remove the pending response handler. eebd14b: Prevent streamable HTTP MCP background SSE disconnects from surfacing as unhandled promise rejections. v2.0.7 Compare Source Patch Changes 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT. Updated dependencies [5c5c0f5] @​ai-sdk/provider@4.0.2 @​ai-sdk/provider-utils@5.0.5 v2.0.6 Compare Source Patch Changes Updated dependencies [d3bcad9] @​ai-sdk/provider@4.0.24 @​ai-sdk/provider-utils@5.0.56 v2.0.5 Compare Source Patch Changes be877ff: Use fetchUntrustedUrl for OAuth metadata discovery, with an explicit opt-in for the MCP protocol-version header. Protocol metadata remains available while unknown headers are withheld from untrusted first-hop URLs. Updated dependencies [be877ff] @​ai-sdk/provider-utils@5.0.48 v2.0.4 Compare Source Patch Changes c43e4b7: fix(mcp): prevent SSRF in OAuth metadata discovery Updated dependencies [5ec21a6] Updated dependencies [7469a3b] Updated dependencies [813bb36] Updated dependencies [c43e4b7] @​ai-sdk/provider@4.0.14 @​ai-sdk/provider-utils@5.0.40 v2.0.3 Compare Source Patch Changes Updated dependencies [3e125ba] @​ai-sdk/provider-utils@5.0.32 v2.0.2 Compare Source Patch Changes Updated dependencies [ad6a650] Updated dependencies [81cd026] @​ai-sdk/provider@4.0.7 @​ai-sdk/provider-utils@5.0.25 v2.0.1 Compare Source Patch Changes Updated dependencies [1659cd5] Updated dependencies [6a5bdff] @​ai-sdk/provider-utils@5.0.15 v2.0.0 Compare Source Major Changes 23fa161: fix(mcp): setting redirect: error for MCP transport ef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers using require() must switch to ESM import syntax. 8359612: Start v7 pre-release Patch Changes b79094c: Add resource_link content type to CallToolResultSchema and PromptMessageSchema per MCP spec. Fixes hard rejection when MCP servers return resource_link content parts with zod ≥ 4.4.x. 78e0023: fix(mcp): await addClientAuthentication in token exchange and refresh b567a6c: dependency updates e33ad0b: fix(mcp): add optional hook to validate authorization servers e3ea484: fix(mcp): bypass outputSchema validation when tool returns isError 93afb28: feat(mcp): expose server instructions to be accessible through client a00d1d3: feat(mcp): allow custom fetch for HTTP and SSE transports a98bf66: feat(mcp): surface 'serverInfo' exposed from the MCP server 2a150f8: fix(mcp): lock first sse endpoint received via event 2655da8: fix(mcp): use negotiated protocol version in transport request headers 9f0e36c: trigger release for all packages after provenance setup f7bc0b4: feat(mcp): expose statusCode, url, and responseBody on MCPClientError for HTTP transport failures MCPClientError now carries structured HTTP context when it originates from the streamable HTTP transport. This lets downstream consumers (e.g. agent frameworks that need to decide whether to fall back from streamable HTTP to legacy SSE transport per the MCP spec) branch on the actual response status without parsing the error message string. Fields are optional — they remain undefined for stdio transport errors and for non-response failures (network errors, aborts). dcefad3: fix(mcp): respond to ping requests with an empty result per JSON-RPC spec (closes #​6282) b44b051: fix(mcp): prevent prototype-named tools from bypassing the schemas allowlist When using client.tools({ schemas }) to expose only an explicitly allowed subset of an MCP server's tools, the allowlist check used the in operator, which also matches inherited Object.prototype properties. A server-advertised tool named constructor, toString, __proto__, etc. would pass the check even though the developer never defined it in schemas, and was then exposed to the model and executable. The check now uses Object.hasOwn, so only explicitly defined tools are returned. f634bac: feat(mcp): add new McpProviderMetadata type b9b3899: changeset for #​13384 1e89d62: fix(mcp): strip trailing slash from OAuth resource parameter 3e0b82f: fix(mcp): support official sdk protocol version negotiation 1451759: feat(mcp): deprecate name and use clientName for MCPClient 7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26. 08d2129: feat(mcp): propagate the server name through dynamic tool parts 58c9eb1: feat(mcp): add redirect option to MCPTransportConfig for controlling HTTP redirect behavior 0c4c275: trigger initial canary release 611f621: feat(mcp): feat(mcp): add support for MCP Apps 9ecd8ae: fix(mcp): add MCP protocol version 2025-11-25 to supported versions 6c17a9f: fix(mcp): deduplicate auth refresh on http transport 69254e0: feat(ai): add toolMetadata for tool specific metdata 258c093: chore: ensure consistent import handling and avoid import duplicates or cycles f0c6770: fix(mcp): prevent mcp oauth credential exfiltration during rediscovery 5463d0d: feat(provider): align tool result output content file part types with top-level message file part types b8396f0: trigger initial beta release b29e087: fix (mcp): handle SSE messages without explicit event fields 90e2d8a: chore: fix unused vars not being flagged by our lint tooling 024a6b4: fix(mcp): validate oauth metadata issuer during discovery 9b0bc8a: fix(mcp): prevent prototype pollution by using secureJsonParse ff5eba1: feat: roll image-* tool output types into their equivalent file-* types v1.0.92 Compare Source Patch Changes ff05827: fix(mcp): authorization server paths beginning with repeated slashes should not bypass authorization server validation v1.0.91 Compare Source Patch Changes 5267a7a: Preserve stored OAuth credentials when an authorization-code exchange returns invalid_grant, without retrying the rejected code. Add optional token context to OAuthClientProvider.invalidateCredentials so providers sharing storage can atomically delete only the rejected token generation and preserve tokens saved by a concurrent refresh. v1.0.90 Compare Source Patch Changes a9cea74: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads. a9cea74: fix(mcp): prevent SSRF in OAuth metadata discovery Updated dependencies [a9cea74] Updated dependencies [a9cea74] Updated dependencies [a9cea74] @​ai-sdk/provider-utils@4.0.57 v1.0.89 Compare Source Patch Changes cdc5b56: Preserve prototype-named tools, providers, and provider metadata as own properties without changing lookup object prototypes. Prevent inherited names from resolving as registered providers or causing image metadata aggregation to fail. v1.0.88 Compare Source Patch Changes Updated dependencies [29dc427] @​ai-sdk/provider-utils@4.0.56 v1.0.87 Compare Source Patch Changes Updated dependencies [3983fea] @​ai-sdk/provider@3.0.18 @​ai-sdk/provider-utils@4.0.55 v1.0.86 Compare Source Patch Changes 86fcba3: fix(mcp): preserve explicit stdio transport environment values v1.0.85 Compare Source Patch Changes 03c91a0: fix(mcp): preserve pre-registered OAuth clients after client authentication errors and require explicit provider provenance before replacing dynamically registered credentials f7f36d2: chore: enable dead code lint rules Updated dependencies [069a945] Updated dependencies [d1a36d2] Updated dependencies [f7f36d2] @​ai-sdk/provider-utils@4.0.54 v1.0.84 Compare Source Patch Changes Updated dependencies [da2e17b] @​ai-sdk/provider@3.0.17 @​ai-sdk/provider-utils@4.0.53 v1.0.83 Compare Source Patch Changes Updated dependencies [82e18b0] @​ai-sdk/provider-utils@4.0.52 v1.0.82 Compare Source Patch Changes 1620182: fix(mcp): avoid duplicate legacy SSE OAuth refreshes for stale 401 responses v1.0.81 Compare Source Patch Changes 5246507: fix(mcp): use the stored authorization server for OAuth callbacks when protected resource metadata rediscovery fails v1.0.80 Compare Source Patch Changes Updated dependencies [1a4dbb1] @​ai-sdk/provider@3.0.16 @​ai-sdk/provider-utils@4.0.51 v1.0.79 Compare Source Patch Changes 3d2db73: fix(mcp): accept trailing slashes on origin-only OAuth issuers v1.0.78 Compare Source Patch Changes 172d3c0: feat(mcp): surface server-provided tool annotations in tool metadata v1.0.77 Patch Changes Updated dependencies [cc23556] @​ai-sdk/provider-utils@4.0.50 v1.0.76 Patch Changes Updated dependencies [9a521b9] @​ai-sdk/provider-utils@4.0.49 v1.0.75 Compare Source Patch Changes 878bdb9: Apply MCP scope selection to dynamic client registration as well as authorization. 204ce6c: fix(mcp): reject private OAuth endpoints before sending credentials v1.0.74 Compare Source Patch Changes e7d359e: Fetch all paginated tool definitions when creating an MCP tool set. Updated dependencies [5642849] @​ai-sdk/provider-utils@4.0.48 v1.0.73 Compare Source Patch Changes b8e4215: fix(mcp): support spawning command shims such as npx on Windows Updated dependencies [2d172fb] @​ai-sdk/provider-utils@4.0.47 v1.0.72 Compare Source Patch Changes 0075ed5: fix(mcp): reject SSE requests when POST responses are unsuccessful v1.0.71 Compare Source Patch Changes b0e77c0: Select MCP OAuth authorization scopes from WWW-Authenticate challenges or Protected Resource Metadata. Updated dependencies [31205a4] @​ai-sdk/provider-utils@4.0.46 Configuration 📅 Schedule: (in timezone UTC) Branch creation "before 9am on Monday" Automerge At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

Open Graph Description: This PR contains the following updates: Package Change Age Confidence @ai-sdk/mcp (source) ^1.0.70 → ^2.0.0 Release Notes vercel/ai (@​ai-sdk/mcp) v2.0.69 Compare Source Patch Changes...

X Description: This PR contains the following updates: Package Change Age Confidence @ai-sdk/mcp (source) ^1.0.70 → ^2.0.0 Release Notes vercel/ai (@​ai-sdk/mcp) v2.0.69 Compare Source Patch Changes...

Opengraph URL: https://github.com/deepnote/deepnote/pull/411

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width