[mannycarrera4]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• modules/mcp/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Insufficiently Protected Credentials SNYK-JS-MODELCONTEXTPROTOCOLSDK-20579853

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[mannycarrera4]

This upgrade introduces a significant breaking change in how server instances and stateless transports are handled.

Breaking Change:

• A single McpServer instance or a stateless Streamable HTTP transport can no longer be shared across multiple requests. According to the release notes, applications reusing a server object for every HTTP request will fail on the second request.

Behavioral Change:

• HTTP client transports will now only follow redirects that stay on the same origin.

Recommendation:
To migrate, you must create a new McpServer and transport instance for each incoming request instead of reusing a single instance. The release notes confirm that factory functions like createMcpHandler(buildServer) that create a new server on every call will continue to work without changes.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Workday/canvas-kit
• Branch: snyk-fix-bec74bb12268db5ad8c5bc1dc8c078c5
• File: .coderabbit.yaml
• Commit: e7fe89f
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 92f6cf93-9bbd-4fa0-89c3-a30c33975843

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cypress]

Workday/canvas-kit    Run #11793

Run Properties:   Passed #11793  •  0226f72d9e ℹ️: Merge e7fe89fb9a4b11be6e85746a3f60fda501c77757 into 21b0c64e5227e1a6aa3208ad5249...

Project	Workday/canvas-kit
Branch Review	snyk-fix-bec74bb12268db5ad8c5bc1dc8c078c5
Run status	Passed #11793
Run duration	02m 56s
Commit	0226f72d9e ℹ️: Merge e7fe89fb9a4b11be6e85746a3f60fda501c77757 into 21b0c64e5227e1a6aa3208ad5249...
Committer	Manuel Carrera
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	17
Skipped	0
Passing	917
View all changes introduced in this branch ↗︎

UI Coverage  14.32%
Untested elements	2564
Tested elements	426

Accessibility  99.22%
Failed rules	4 critical   5 serious   3 moderate   2 minor
Failed elements	75

[jaclynjessup]

✅ This PR has been automatically closed

The security issues addressed by this pull request are no longer present in the latest project scan. All vulnerabilities this PR was created to fix have been resolved through other means (e.g., dependency updates, direct fixes, or changes in vulnerability data).

Resolved Issues

• SNYK-JS-MODELCONTEXTPROTOCOLSDK-20579853

What should I do?

No action is required. If you believe this PR was closed in error, you can reopen it and contact Snyk support.

---

This action was performed automatically by Snyk.