build(deps): Bump the production-minor-patch group across 1 directory with 11 updates

[dependabot]

Bumps the production-minor-patch group with 11 updates in the / directory:

Package	From	To
@modelcontextprotocol/node	2.0.0	2.1.0
@modelcontextprotocol/server	2.0.0	2.2.0
bson	7.3.2	7.3.3
dompurify	3.4.15	3.4.16
js-yaml	5.4.1	5.4.2
markdown-it	15.0.1	15.0.2
moment	2.30.1	2.31.0
moment-timezone	0.6.3	0.6.4
sql-formatter	15.8.2	15.9.0
xregexp	5.1.2	5.1.3
zod	4.6.1	4.6.5

Updates @modelcontextprotocol/node from 2.0.0 to 2.1.0

Release notes

Sourced from @​modelcontextprotocol/node's releases.

@​modelcontextprotocol/node@​2.1.0

Minor Changes

• #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource_metadata parameter is derived from the verified AuthInfo: requireBearerAuth / verifyBearerToken now stamp their configured resourceMetadataUrl onto the AuthInfo they return (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the well-known location for an HTTP(S) RFC 8707 resource identifier; the parameter is omitted when neither is available.

Patch Changes

• #2698 7b781ed Thanks @​maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport built on it), createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at 4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio bound their reads too) and answers 413 Payload Too Large before anything is parsed. toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy so the modern handler answers it. JSON-RPC batch arrays are limited to 100 messages; a longer batch is answered 400 / -32600 and none of it is dispatched.

  The limit is configurable with a new maxRequestBodySize option (bytes, default DEFAULT_MAX_REQUEST_BODY_SIZE = 4 MiB, exported from @modelcontextprotocol/server) on WebStandardStreamableHTTPServerTransportOptions, CreateMcpHandlerOptions (forwarded to its stateless legacy leg; isLegacyRequest and legacyStatelessFallback take the same option), CreateMcpHonoAppOptions, and ToNodeHandlerOptions / ToWebRequestOptions (the adapter's bound applies before the handler's, so raise both). The bounded reader is exported as readRequestBody for adapter authors. Hosts that pre-parse the body and pass it as parsedBody skip the SDK's read and its size limit entirely; the batch bound applies either way.

  createMcpHonoApp and createMcpExpressApp now run their Host/Origin validation before the JSON body parser, so a request from a disallowed Host or Origin with an invalid JSON body is answered 403 rather than 400, and its body is not read.

• Updated dependencies [6fa4227, 03842cd, 3e90449, 7b781ed, 75dc7ea, 6032170, 6a05402, 70de0c8]:

  • @​modelcontextprotocol/server@​2.1.0

Commits

• 9517506 Version Packages (#2808)
• 6a05402 fix(server): close StdioServerTransport when stdin ends or closes (#2494)
• c4248a9 fix(client): add missing Windows env vars to DEFAULT_INHERITED_ENV_VARS (#2043)
• 0b403f0 chore(changesets): only bump peer dependents when out of range (#2819)
• 6032170 feat(server): add request-time OAuth scope challenges (#1624)
• b654261 fix(client): let OAuth-derived Authorization override caller-supplied header ...
• 5ecc791 fix(codemod): only count real module specifiers in project-type inference (#2...
• 5119ee7 fix: preserve exact OAuth resource indicators (#2581)
• 6fa4227 fix(client): surface underlying network error via Error.cause on probe failur...
• dcc0102 feat(client): add DPoP (RFC 9449) sender-constrained token support (#2629)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0 to 2.2.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.2.0

Patch Changes

• Updated dependencies [edd12e2]:
  • @​modelcontextprotocol/core@​2.2.0

@​modelcontextprotocol/server@​2.2.0

Patch Changes

• #2885 9dd722f Thanks @​claude! - Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection (seen as unhandledrejection on Cloudflare Workers) in addition to the returned rejection.

• #2778 e3fb9ed Thanks @​vjymisal0! - Fix a stack overflow in createMcpHandler when the factory returns the same server instance for more than one request. Returning a fresh instance per request is still required.

• #2651 c55efa6 Thanks @​sushantkumar23! - createMcpHandler now ends a subscriptions/listen stream right after the acknowledgement when it honored none of the requested notification types, instead of holding the stream open with nothing to deliver. The client receives the acknowledgement and then the resultType: "complete" result. Streams that honor at least one type are unchanged.

• Updated dependencies [edd12e2]:

  • @​modelcontextprotocol/core@​2.2.0

@​modelcontextprotocol/server-legacy@​2.1.0

Patch Changes

• Updated dependencies [dcc0102]:
  • @​modelcontextprotocol/core@​2.1.0

@​modelcontextprotocol/server@​2.1.0

Minor Changes

• #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource_metadata parameter is derived from the verified AuthInfo: requireBearerAuth / verifyBearerToken now stamp their configured resourceMetadataUrl onto the AuthInfo they return (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the well-known location for an HTTP(S) RFC 8707 resource identifier; the parameter is omitted when neither is available.

Patch Changes

• #2726 6fa4227 Thanks @​LuckTerence! - SdkError and SdkHttpError accept standard ErrorOptions as an optional fourth constructor argument and forward it to Error, so a wrapped error is reachable through the standard Error.cause chain. Version-negotiation probe failures (SdkErrorCode.EraNegotiationFailed) now use it: the underlying TypeError: fetch failed and the DNS or socket error beneath it surface via error.cause, so pino, Sentry, and util.inspect render ENOTFOUND / ECONNREFUSED / ETIMEDOUT instead of stopping at the SdkError (#2657). The previous error.data.cause slot is still populated for compatibility but is deprecated and slated for removal; read error.cause instead.

• #2654 03842cd Thanks @​pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

... (truncated)

Commits

• dd22ba2 Version Packages (#2849)
• c55efa6 fix(server): close a listen stream that has honored nothing (#2651)
• edd12e2 fix(client): deprecate omitting expectedIssuer and apply the SEP-2352 issuer ...
• ef39308 fix(client): follow nextCursor until it is absent; stop on a repeated page (#...
• 9dd722f fix(core): await the notification send so a failed send is never briefly unha...
• e780e13 fix(client): preserve _meta on input_required results (#2862)
• a4ae2f9 docs(client): correct the registerClient deprecation citation to spec PR #285...
• efebf5b docs(client): correct token endpoint TLS citation (#2768)
• d992df7 chore: remove CODEOWNERS patterns that match nothing on main (#2884)
• c0f7aec fix(client): inline jose types in the CommonJS declaration file (#2883)
• Additional commits viewable in compare view

Updates bson from 7.3.2 to 7.3.3

Release notes

Sourced from bson's releases.

v7.3.3

7.3.3 (2026-09-11)

The MongoDB Node.js team is pleased to announce version 7.3.3 of the bson package!

Release Notes

Fixed BSON.calculateObjectSize infinite hang

Fixed a bug where BSON.calculateObjectSize would hang indefinitely on an object containing a circular reference. The method now throws an exception when a circular reference is detected.

Also a big thank you to @​mcmorisi for his contribution on #912 security warning in EJSON.parse documentation!

Bug Fixes

• NODE-7696: calculateObjectSize hangs indefinitely on an object containing a circular reference (#926) (f35af5c)

Documentation

• API
• Changelog

We invite you to try the bson library immediately, and report any issues to the NODE project.

Changelog

Sourced from bson's changelog.

7.3.3 (2026-09-11)

Bug Fixes

• NODE-7696: calculateObjectSize hangs indefinitely on an object containing a circular reference (#926) (f35af5c)

Commits

• 7b8f7b7 chore(main): release 7.3.3 (#927)
• 27f1ef6 test(NODE-7545): update deep_bson.json from mongodb/specifications (#925)
• 9b58a51 docs(NODE-7668): Add security warning to EJSON.parse documentation (#912)
• d3f563e chore(NODE-7806): restrict release_notes to PRs from this repository (#929)
• f35af5c fix(NODE-7696): calculateObjectSize hangs indefinitely on an object containin...
• 8699bb4 chore(NODE-7672): update dependencies (#922)
• 8a9085d docs(NODE-7682): add agents file (#915)
• See full diff in compare view

Updates dompurify from 3.4.15 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

Commits

• b9b9d80 release: 3.4.16 (#1636)
• See full diff in compare view

Updates js-yaml from 5.4.1 to 5.4.2

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

Commits

• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• See full diff in compare view

Updates markdown-it from 15.0.1 to 15.0.2

Changelog

Sourced from markdown-it's changelog.

[15.0.2] - 2026-09-11

Security

• Fixed quadratic complexity in smartquotes when quote types don't match, #1209. Also limited the smartquotes stack to 1000 unmatched openers.

Commits

• 3c51991 15.0.2 released
• cf27366 Polish #1209 and limit smartquotes stack to 1000 openers
• 1b379c1 Fix quadratic complexity in smartquotes rule when quote types don't match (#1...
• See full diff in compare view

Updates moment from 2.30.1 to 2.31.0

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Commits

• 15b45d4 [pkg] Build 2.31.0 (#6452)
• 631cd81 [pkg] Update changelog for upcoming release (#6394)
• 6caff9e Merge commit from fork
• 710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
• 863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
• 2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
• 9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
• f6eefc5 [bugfix] Validate timezone offset range (#6446)
• 136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
• 0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Updates moment-timezone from 0.6.3 to 0.6.4

Release notes

Sourced from moment-timezone's releases.

Release 0.6.4

• Updated data to IANA TZDB 2026d. #1157
• Fixed calendar arithmetic around time zone gaps. #1151
• Fixed default date selection when creating a zoned Moment with only time fields.
  • Object inputs (e.g. moment.tz({ hour: 9 }, zoneName)). #1156
  • String inputs (e.g. moment.tz('09:00', 'HH:mm', zoneName)). #1159
  • Using un-zoned moment() when there is also a zone set with moment.tz.setDefault(zoneName). #1161
    • NOTE: This specific fix only works when also using core moment version 2.31.0 or higher. All other fixes in this release work with all supported versions of moment.

Changelog

Sourced from moment-timezone's changelog.

0.6.4 2026-09-15

• Updated data to IANA TZDB 2026d. #1157
• Fixed calendar arithmetic around time zone gaps. #1151
• Fixed default date selection when creating a zoned Moment with only time fields.
  • Object inputs (e.g. moment.tz({ hour: 9 }, zoneName)). #1156
  • String inputs (e.g. moment.tz('09:00', 'HH:mm', zoneName)). #1159
  • Using un-zoned moment() when there is also a zone set with moment.tz.setDefault(zoneName). #1161
    • NOTE: This specific fix only works when also using core moment version 2.31.0 or higher. All other fixes in this release work with all supported versions of moment.

Commits

• 3722a7d Bump version and build moment-timezone 0.6.4
• 70b06e9 Merge pull request #1161 from moment/mjp/fix-default-zone-date-defaults
• afac5bd [bugfix] Apply default zone to omitted date fields
• 114242a Merge pull request #1159 from moment/mjp/fix-119
• 0662d8b [bugfix] Use target zone for string date defaults
• 9da68c4 data: Add 2026d (#1157)
• 518ab31 build(deps): bump js-yaml and grunt (#1155)
• ffe3e48 build(deps): bump browserslist from 4.21.5 to 4.28.8 (#1154)
• 4282f22 [bugfix] Use target zone for object date defaults (#1156)
• 7030b19 build(deps): bump brace-expansion (#1152)
• Additional commits viewable in compare view

Updates sql-formatter from 15.8.2 to 15.9.0

Release notes

Sourced from sql-formatter's releases.

15.9.0

Parsing improvements

• Support \restrict and \unrestrict commands found in SQL created by pg_dump (#935) (thanks to sophalter)
• Treat a reserved word after AS as an alias (#801, #972) (thanks to Christopher Pruijsen)
• Support % as the modulo operator in SingleStoreDB (#578, #971) (thanks to Max Freedom Pollard)

Formatting improvements

• Keep a space when densing - before a negative operand (thanks to Sarath Francis)
• Keep spaces around PostgreSQL OPERATOR() with denseOperators (#958) (thanks to Sarath Francis)
• Remove extra space after BETWEEN _ AND _ expression (#959) (thanks to Sarath Francis)
• Keep DuckDB array-slice colon dense inside [] (#960) (thanks to Vincent Gao)

Performance

• Avoid quadratic accumulation when parsing long SQL expression lists (#840, #963) (thanks to Alex Coleman)

Commits

• 63dc9f8 15.9.0
• a9a2223 Add a note about the need to pnpm login for release
• 021b391 Treat a reserved word after AS as an alias (#972)
• b77a536 Add Christopher Pruijsen to AUTHORS
• 55c68bb Address review: narrow isAsKeyword, move tests to shared helpers
• bcd3a42 Treat a reserved word after AS as an alias
• a68e988 Support % as the modulo operator in SingleStoreDB (#971)
• 1ff85d8 Add Max Freedom Pollard to AUTHORS
• de7587e fix(singlestoredb): support % as the modulo operator
• f6de1cd Merge branch 'fix/pgdump-restrict-commands'
• Additional commits viewable in compare view

Updates xregexp from 5.1.2 to 5.1.3

Release notes

Sourced from xregexp's releases.

v5.1.3

Improvements

• Use Object.setPrototypeOf instead of __proto__ when augmenting regexes. (#364)

Bug Fixes

• Reject inherited property names used as flags in XRegExp and XRegExp.cache. (#365)

Commits

• 7030eed chore: prepare 5.1.3 release
• 39c5277 build: verify generated artifacts before packing
• f4cfbfe test: align browser Jasmine version with package dependencies
• 31317c1 build: remove nyc coverage tooling
• e766095 build: update dependencies to latest compatible versions
• 3b02d1b fix(xregexp): reject inherited flag and feature names
• a6d0994 build: migrate from npm to pnpm and update CI
• e2fd027 fix: replace proto with Object.setPrototypeOf
• 4e13762 Bump deps
• d31a077 Bump deps; related adjustments
• See full diff in compare view

Updates zod from 4.6.1 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: doublegate/CyberChef-MCP/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2bc643e8-a5d8-45d1-9f0d-0e54b1ad33b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	dompurify@​3.4.15 ⏵ 3.4.16	+1	+1		-1
	@​modelcontextprotocol/​server@​2.0.0 ⏵ 2.2.0	+1		+1
	js-yaml@​5.4.1 ⏵ 5.4.2	+1		+1	+1
	markdown-it@​15.0.1 ⏵ 15.0.2	+1		+1	-1
	xregexp@​5.1.2 ⏵ 5.1.3	+1			+7
	bson@​7.3.2 ⏵ 7.3.3			+1	-3
	moment@​2.30.1 ⏵ 2.31.0	+1	+2	+8
	sql-formatter@​15.8.2 ⏵ 15.9.0	+1		+1	-1
	moment-timezone@​0.6.3 ⏵ 0.6.4	+1		+1	+3
	@​modelcontextprotocol/​node@​2.0.0 ⏵ 2.1.0	+1		+1	+4
	zod@​4.6.1 ⏵ 4.6.5

View full report

[github-actions]

Antigravity review (Gemini via Ultra)

This is a trivial dependency bump that updates minor and patch versions for several production dependencies.

Blocking issues

None found.

Suggestions

• package.json (line 121): @modelcontextprotocol/node is bumped to ^2.1.0, which demands a peer dependency of @modelcontextprotocol/server@^2.1.0 (as seen in the lockfile diff). While npm successfully resolved @modelcontextprotocol/server to 2.2.0 (which satisfies your existing ^2.0.0 constraint), you should explicitly bump "@modelcontextprotocol/server" to ^2.1.0 or ^2.2.0 in package.json to keep your top-level constraints strictly aligned with your peer requirements.

Nitpicks

• The PR title claims "11 updates", but there are only 10 explicit package constraint modifications in package.json (the 11th is likely @modelcontextprotocol/server getting updated in the lockfile alone).

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}

[doublegate]

Superseded by consolidated pull request #153 which updates all dependencies to their newest stable versions, resolves issues #145 and #149, and passes all test suites.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml