[ferrlabs-renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@ferrlabs/mcp-core (source)	^10.14.0 → ^10.14.3

---

Release Notes

FerrLabs/MCP (@​ferrlabs/mcp-core)

v10.14.3

Compare Source

Bug Fixes

• fix(transport): validate the bearer before building a server (#​474)

v10.14.2

Compare Source

Bug Fixes

• fix(core): reject dot segments in API request paths (#​470)

v10.14.1

Compare Source

Bug Fixes

• fix(deps): override vulnerable transitive deps flagged by pnpm audit (#​469)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Every minute (* * * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet-interne]

Patch bump within 10.14.x. The manifest and lockfile agree (specifier, resolution and snapshot all point at 10.14.2), and the transitive deps are unchanged. The ajv-formats peer metadata the lockfile gained is pnpm writing out the optional ajv peer, so it isn't a new dependency. CI was still running when I reviewed, so check that Test & Build is green before merging.

[ferrfleet-interne]

Re-checked after the rebase to 10.14.3. The manifest specifier, importer entry, package resolution and snapshot all agree on 10.14.3, and the transitive deps (@modelcontextprotocol/sdk 1.32.1) haven't changed. CI is still running on this commit.

[ferrfleet-interne]

c79c923 is correct. On main the run branch of outcomeSchema has no action discriminator and declares agent_id twice, so the last key wins and the .min(1) is lost. This commit adds action: z.literal('run') back and keeps the stricter agent_id, so an empty string is now rejected. The lockfile bump hasn't changed since my last approval.

Nit: this fix is unrelated to the dependency bump and main is broken until it lands. A separate PR would get it in sooner and keep the history clear. Now that a human has committed to this branch, Renovate will also stop rebasing it.