Skip to content

build(deps): bump the production-dependencies group across 1 directory with 9 updates - #10

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-00a45b00b4
Closed

build(deps): bump the production-dependencies group across 1 directory with 9 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-00a45b00b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 9 updates in the / directory:

Package From To
@astrojs/cloudflare 14.1.3 14.2.0
astro 7.1.1 7.2.0
@modelcontextprotocol/sdk 1.29.0 1.30.0
agents 0.17.4 0.20.1
hono 4.12.31 4.13.1
jose 6.2.3 6.2.8
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
react-router-dom 7.18.1 7.18.2

Updates @astrojs/cloudflare from 14.1.3 to 14.2.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.2.0

Minor Changes

  • #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    export default defineConfig({
  adapter: cloudflare({
    imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
  }),
});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.7

Patch Changes

  • #17543 bbc1ec9 Thanks @​ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.6

Patch Changes

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.2.0

Minor Changes

  • #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    export default defineConfig({
  adapter: cloudflare({
    imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
  }),
});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.7

Patch Changes

  • #17543 bbc1ec9 Thanks @​ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.6

... (truncated)

Commits
  • 60e9432 [ci] release (#17558)
  • a2240c4 fix(test): provide experimental config in Cloudflare session-false test (#17606)
  • 961bbe5 Experimental incremental static builds (#17084)
  • 90c98ae feat(session): add session: false to opt out of session support (#16871)
  • 2b8915a fix(cloudflare): inline executionCtx type in HonoCloudflareContextLike to avo...
  • 0a79753 fix(cloudflare): use workerd-safe dev image endpoint for custom image service...
  • 2a59663 Add opt-in Cloudflare binding image optimization during build (#16194)
  • 0c32649 fix(cloudflare): don't mutate immutable headers on cached responses (#17481)
  • ce83c39 fix(@​astrojs/cloudflare): fix imageService: 'compile' silent noop with `pre...
  • 9865d1c [ci] release (#17539)
  • Additional commits viewable in compare view

Updates astro from 7.1.1 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

  • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    astro preview --background

    When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

    astro preview status
astro preview logs
astro preview logs --follow
astro preview stop

    If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

    To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

  • #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

    Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

    • ... (truncated)

    Changelog

    Sourced from astro's changelog.

    7.2.0

    Minor Changes

    • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

      This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

      astro preview --background

      When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

      astro preview status
astro preview logs
astro preview logs --follow
astro preview stop

      If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

      To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

    • #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

      Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

      // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});

    Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    import type { AstroPrerenderer, PrerenderResult } from 'astro';

    • ... (truncated)

    Commits

    Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

    Release notes

    Sourced from @​modelcontextprotocol/sdk's releases.

    1.30.0

    What's Changed

    New Contributors

    Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

    Commits
    • 2d889f2 chore: bump version to 1.30.0 (#2563)
    • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
    • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
    • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
    • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
    • 369513d fix: support Zod 3.25 method literals (#2368)
    • e7ee57c v1 stdio buffer limit (#2239)
    • c36e1ef Add end-to-end test suite (#2167)
    • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
    • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
    • See full diff in compare view
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


    Updates agents from 0.17.4 to 0.20.1

    Release notes

    Sourced from agents's releases.

    agents@0.20.1

    Patch Changes

    • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

    • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

      Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

      chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

      v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

    agents@0.20.0

    Minor Changes

    • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

      Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

      The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

      The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

      The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

      The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

      @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

      Deprecations in this release:

      • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
      • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
      • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

      experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

    Patch Changes

    • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

    agents@0.19.0

    Minor Changes

    • #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

      The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when

    ... (truncated)

    Changelog

    Sourced from agents's changelog.

    0.20.1

    Patch Changes

    • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

    • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

      Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

      chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

      v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

    0.20.0

    Minor Changes

    • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

      Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

      The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

      The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

      The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

      The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

      @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

      Deprecations in this release:

      • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
      • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
      • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

      experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

    Patch Changes

    • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

    0.19.0

    Minor Changes

    ... (truncated)

    Commits

    Updates hono from 4.12.31 to 4.13.1

    Release notes

    Sourced from hono's releases.

    v4.13.1

    What's Changed

    New Contributors

    Full Changelog: honojs/hono@v4.13.0...v4.13.1

    v4.13.0

    Hono v4.13.0 is now available!

    The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

    Performance improvements

    This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

    Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

    Benchmark v4.12 v4.13 Speedup
    ping — GET / 165.83 ns 163.99 ns 1.01x
    query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
    json — GET /user 528.99 ns 422.44 ns 1.25x
    body — POST /json 1.16 µs 1.00 µs 1.15x

    The individual changes:

    In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

    Thanks @​kibertoad for the contributions!

    First-class QUERY method support

    The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

    const app = new Hono()
</tr></table>

    ... (truncated)

    Commits
    • cf78528 4.13.1
    • f6aa913 fix(etag): skip unsafe methods or error responses on non-* case (#5196)
    • cd31bc1 fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)
    • 569b419 fix(trie-router): count every slash a pattern consumes (#5189)
    • 192768f 4.13.0
    • b0c2d90 Merge pull request #5154 from honojs/next
    • 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
    • 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
    • 3feb355 fix(jsx): allow a function component to return an array (#5179)
    • 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
    • Additional commits viewable in compare view

    Updates jose from 6.2.3 to 6.2.8

    Release notes

    Sourced from jose's releases.

    v6.2.8

    Fixes

    • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
    • reject a non-string "alg" in EmbeddedJWK (714f870)

    Refactor

    • index the JWS and JWE registries without a wrapper (925f3bb)
    • name the "alg" source in unsupported algorithm failures (1500459)

    v6.2.7

    Fixes

    • require own JOSE properties for presence checks (90ab09c)

    Refactor

    v6.2.6

    Fixes

    • types: accept host CryptoKey declarations (b48a15b)

    v6.2.5

    Fixes

    • compare claim values for falsy validation options (eb86956)
    • forward key management parameters for a single JWE recipient (2d4f801)
    • handle a zero-length JWE additional authenticated data (16ca398)
    • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
    • reject an unencoded payload in the JWS Compact Serialization (01d053f)
    • reject characters outside the Base64URL alphabet (0ebb971), references #879
    • reject duplicat...

      Description has been truncated

    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 4, 2026
    @dependabot
    build(deps): bump the production-dependencies group across 1 director…
    caa369b 
    …y with 9 updates

Bumps the production-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.3` | `14.2.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.1` | `7.2.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.17.4` | `0.20.1` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.1` |
| [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.8` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.2` |



Updates `@astrojs/cloudflare` from 14.1.3 to 14.2.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.2.0/packages/integrations/cloudflare)

Updates `astro` from 7.1.1 to 7.2.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.0/packages/astro)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `agents` from 0.17.4 to 0.20.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.20.1/packages/agents)

Updates `hono` from 4.12.31 to 4.13.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.13.1)

Updates `jose` from 6.2.3 to 6.2.8
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.3...v6.2.8)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `react-router-dom` from 7.18.1 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: agents
  dependency-version: 0.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-router-dom
  dependency-version: 7.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot
    dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-00a45b00b4 branch from 3129ea0 to caa369b Compare August 11, 2026 12:47
    @dependabot @github

    dependabot Bot commented on behalf of github Sep 1, 2026

    Copy link
    Copy Markdown
    Contributor Author

    Looks like these dependencies are updatable in another way, so this is no longer needed.

    @dependabot dependabot Bot closed this Sep 1, 2026
    @dependabot
    dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-00a45b00b4 branch September 1, 2026 12:52
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    No reviews

    Assignees

    No one assigned

    Labels

    dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    0 participants