dependabot[bot] opened a new pull request, #59: URL: https://github.com/apache/echarts-mcp/pull/59
Bumps [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) to 2.2.0 and updates ancestor dependency [@modelcontextprotocol/inspector](https://github.com/modelcontextprotocol/inspector). These dependencies need to be updated together. Updates `@modelcontextprotocol/client` from 2.0.0 to 2.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/typescript-sdk/releases";>@modelcontextprotocol/client's releases</a>.</em></p> <blockquote> <h2><code>@modelcontextprotocol/client</code><a href="https://github.com/2";><code>@2</code></a>.2.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2887";>#2887</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd";><code>edd12e2</code></a> Thanks <a href="https://github.com/maxisbey";><code>@maxisbey</code></a>! - Constructing <code>ClientCredentialsProvider</code>, <code>PrivateKeyJwtProvider</code>, <code>StaticPrivateKeyJwtProvider</code> or <code>CrossAppAccessProvider</code> without <code>expectedIssuer</code> is deprecated: the constructor logs one <code>console.warn</code> and that call signature is marked <code>@deprecated</code>. Behaviour is otherwise unchanged. Pass the <code>issuer</code> of the authorization server the credentials were registered with.</p> <p><code>fetchToken()</code> throws <code>AuthorizationServerMismatchError</code>, before sending anything, when the provider's client information is bound to a different authorization server than the one it is called with. The <code>AuthorizationServerMismatchError</code> message no longer assumes the authorization-code callback; its fields are unchanged.</p> <p><code>OAuthTokensSchema</code> and <code>OAuthClientInformationSchema</code> accept the optional <code>issuer</code> stamp, so a provider that reads storage back through them keeps it. <code>auth()</code> overwrites it on every save.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2885";>#2885</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/9dd722fd0b533b3cb44cd2834409f7ea4dd32b00";><code>9dd722f</code></a> Thanks <a href="https://github.com/apps/claude";><code>@claude</code></a>! - Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection (seen as <code>unhandledrejection</code> on Cloudflare Workers) in addition to the returned rejection.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2883";>#2883</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c0f7aec2925a46b32dc2f2aad5bf636a36f02c78";><code>c0f7aec</code></a> Thanks <a href="https://github.com/apps/claude";><code>@claude</code></a>! - Fix a type-check failure for CommonJS TypeScript projects introduced in 2.1.0: <code>dist/index.d.cts</code> imported types from <code>jose</code>, which is ESM-only, so <code>tsc</code> with <code>module: node16</code>/<code>node18</code> and <code>skipLibCheck: false</code> failed with TS1479. The two <code>jose</code> types used by the DPoP API (<code>CryptoKey</code>, <code>JWK</code>) are now inlined into the declaration files. No runtime change.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2768";>#2768</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/efebf5b2ba2f07c6fa27ada824a0999b801fec0a";><code>efebf5b</code></a> Thanks <a href="https://github.com/web-abin";><code>@web-abin</code></a>! - Correct the JSDoc for insecure OAuth token endpoints. The TLS requirement comes from the MCP authorization specification's OAuth 2.1 communication-security rules, not SEP-2207, which covers OIDC-flavored refresh-token guidance. Documentation only; no runtime behavior change.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2729";>#2729</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a4ae2f98da3814a9290f2791cfcca8148dcec978";><code>a4ae2f9</code></a> Thanks <a href="https://github.com/apps/claude";><code>@claude</code></a>! - Correct the <code>registerClient</code> <code>@deprecated</code> notice: Dynamic Client Registration was deprecated by spec PR modelcontextprotocol#2858 (Client ID Metadata Documents), not SEP-2577 (which deprecates roots, sampling, and logging). The notice now also names the earliest possible removal date under the feature lifecycle policy (2027-07-28) and clarifies that the <code>client_id_metadata_document_supported</code> gating lives in the built-in <code>auth()</code> flow — <code>registerClient</code> called directly always sends the registration request. Documentation only; no runtime behavior change.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2862";>#2862</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e780e13869ad419a864b669bd5fa9702cfb36b14";><code>e780e13</code></a> Thanks <a href="https://github.com/SyedTashfin";><code>@SyedTashfin</code></a>! - Preserve <code>_meta</code> on <code>input_required</code> results. The 2026-07-28 decode seam rebuilt the payload from <code>inputRequests</code> and <code>requestState</code> only, so result-level metadata a server sent on an <code>input_required</code> result (including <code>io.modelcontextprotocol/serverInfo</code>) was dropped before an <code>allowInputRequired: true</code> caller could see it. <code>Result._meta</code> is a result-level field, so <code>input_required</code> carries it exactly like any other result.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2886";>#2886</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef39308e963496b75e50553f6265d99cacb4fbb9";><code>ef39308</code></a> Thanks <a href="https://github.com/apps/claude";><code>@claude</code></a>! - <code>listTools()</code>, <code>listPrompts()</code>, <code>listResources()</code> and <code>listResourceTemplates()</code> called without a cursor now follow <code>nextCursor</code> until the server stops sending one, instead of stopping silently with a short list when a cursor repeats; a page that has the same items and the same <code>nextCursor</code> as the page before it ends the walk and is not added twice, and <code>listMaxPages</code> still caps the walk.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2642";>#2642</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/cfa09db614308eaf4fd575c89833da8878d4acb7";><code>cfa09db</code></a> Thanks <a href="https://github.com/apps/claude";><code>@claude</code></a>! - Fix <code>Client.listen()</code> rejections escaping as process-level unhandled rejections. The internal <code>opening</code> promise could reject (ack timeout, transport close, server cancel, caller abort) while <code>listen()</code> was still serially awaiting <code>transport.send(...)</code>, so no rejection handler was attached yet — the rejection surfaced as an <code>unhandledRejection</code> that caller-side handling cannot prevent, and a send that never settles (e.g. a stdio write parked on <code>'drain'</code>) left <code>listen()</code> suspended forever even though the ack timer had already fired. <code>listen()</code> now suspends on the <code>opening</code> s tate machine directly and routes send failures into it, so every termination path rejects the returned promise and nothing escapes.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2597";>#2597</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/7f7a94c22017e121a960e071bb50ec75e34450bd";><code>7f7a94c</code></a> Thanks <a href="https://github.com/arimu1";><code>@arimu1</code></a>! - Treat hostnames ending in <code>.localhost</code> as loopback for the SEP-2207 token-endpoint https guard (RFC 6761 §6.3), so host-based multi-tenant local OAuth works. The SDK does not resolve the name itself: <code>*.localhost</code> reaches the local machine only if the system resolver follows RFC 6761.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd";><code>edd12e2</code></a>]:</p> <ul> <li><code>@modelcontextprotocol/core</code><a href="https://github.com/2";><code>@2</code></a>.2.0</li> </ul> </li> </ul> <h2><code>@modelcontextprotocol/client</code><a href="https://github.com/2";><code>@2</code></a>.1.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2629";>#2629</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/dcc01028ff6a499a5728c2b6181c1727d52e2fab";><code>dcc0102</code></a> Thanks <a href="https://github.com/gbshankar";><code>@gbshankar</code></a>! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client. <ul> <li>Opt in by implementing <code>OAuthClientProvider.dpop()</code> returning a <code>DpopSession</code> (new, along with <code>generateDpopKeyPair</code>, <code>accessTokenHash</code>, <code>isDpopNonceChallenge</code>). <code>auth()</code> / <code>exchangeAuthorization</code> / <code>refreshAuthorization</code> / <code>fetchToken</code> then sign a DPoP proof into token requests (retrying once on an authorization-server <code>use_dpop_nonce</code> challenge, with client authentication re-applied per attempt), and <code>StreamableHTTPClientTransport</code>, <code>SSEClientTransport</code> and <code>withOAuth</code> present a <code>token_type: "DPoP"</code> access token as <code>Authorization: DPoP <token></code> plus a fresh per-request proof, retry a resource-server <code>use_dpop_nonce</code> challenge once, and pick up a <code>DPoP-Nonce</code> delivered on any response. Tokens the AS issued as <code>Bearer</code> are still presented as Bearer.</li> <li>DPoP is applied at the fetch layer: the transports wrap their resource-server <code>fetch</code> (including a caller-supplied <code>fetch</code> / <code>eventSourceInit.fetch</code>) with the new <code>withDpopFromProvider(provider)</code> middleware, so proofs are always bound to the request actually sent. <code>withDpop(session, getToken)</code> is exported for callers that manage tokens themselves (e.g. alongside a minimal <code>AuthProvider</code>); the <code>AuthProvider</code> interface itself is unchanged.</li> <li><code>auth()</code> now recovers from <code>invalid_dpop_proof</code> on refresh (e.g. a refresh token bound to a key that is no longer held) by discarding the tokens and re-authorizing, like <code>invalid_grant</code>. <code>OAuthErrorCode</code> gains <code>InvalidDpopProof</code> and <code>UseDpopNonce</code>; <code>extractWWWAuthenticateParams</code> recognizes the <code>DPoP</code> challenge scheme; <code>OAuthMetadataSchema</code> gains <code>dpop_signing_alg_values_supported</code>.</li> </ul> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2726";>#2726</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/6fa42279fecaba423635072f716bbb2f6f7c77f3";><code>6fa4227</code></a> Thanks <a href="https://github.com/LuckTerence";><code>@LuckTerence</code></a>! - <code>SdkError</code> and <code>SdkHttpError</code> accept standard <code>ErrorOptions</code> as an optional fourth constructor argument and forward it to <code>Error</code>, so a wrapped error is reachable through the standard <code>Error.cause</code> chain. Version-negotiation probe failures (<code>SdkErrorCode.EraNegotiationFailed</code>) now use it: the underlying <code>TypeError: fetch failed</code> and the DNS or socket error beneath it surface via <code>error.cause</code>, so pino, Sentry, and <code>util.inspect</code> render <code>ENOTFOUND</code> / <code>ECONNREFUSED</code> / <code>ETIMEDOUT</code> instead of stopping at the <code>SdkError</code> (<a href="ht tps://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2657">#2657</a>). The previous <code>error.data.cause</code> slot is still populated for compatibility but is deprecated and slated for removal; read <code>error.cause</code> instead.</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2654";>#2654</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/03842cd9cae9a9b142c77d2fb65e829fc4e03eab";><code>03842cd</code></a> Thanks <a href="https://github.com/pshah19";><code>@pshah19</code></a>! - Treat request id <code>0</code> as a real id. Two guards tested a <code>RequestId</code> for truthiness, so the legal JSON-RPC ids <code>0</code> and <code>''</code> were read as absent. Id <code>0</code> is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first <code>sampling/createMessage</code>, <code>elicitation/create</code>, or <code>roots/list</code> a server sends.</p> <ul> <li><code>notifications/cancelled</code> carrying id <code>0</code> was ignored, and the in-flight handler ran to completion with its <code>AbortSignal</code> never fired.</li> <li>A notification sent with <code>relatedRequestId: 0</code> wrongly passed the debounce gate (for methods opted into <code>debouncedNotificationMethods</code>). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.</li> </ul> <p>Absent is now the only value that means "no id".</p> </li> <li> <p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2043";>#2043</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c4248a935f245a86b2fb8b88b9c3d594e2bfea75";><code>c4248a9</code></a> Thanks <a href="https://github.com/ChrisJr404";><code>@ChrisJr404</code></a>! - On Windows, stdio servers spawned by <code>StdioClientTransport</code> now also inherit <code>COMSPEC</code>, <code>PATHEXT</code>, <code>PROGRAMDATA</code>, <code>PROGRAMFILES(X86)</code>, <code>PROGRAMW6432</code>, and <code>WINDIR</code> (added to <code>DEFAULT_INHERITED_ENV_VARS</code>). Programs a server launches can depend on them: PowerShell finds no native executables without <code>PATHEXT</code>, and Windows OpenSSH exits 255 without <code>ProgramData</code>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/dd22ba25ddbe7cd8822e1fe9c738a974996a28f6";><code>dd22ba2</code></a> Version Packages (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2849";>#2849</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c55efa62fc4218592418ffbd313d1a906286f1d3";><code>c55efa6</code></a> fix(server): close a listen stream that has honored nothing (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2651";>#2651</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd";><code>edd12e2</code></a> fix(client): deprecate omitting expectedIssuer and apply the SEP-2352 issuer ...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef39308e963496b75e50553f6265d99cacb4fbb9";><code>ef39308</code></a> fix(client): follow nextCursor until it is absent; stop on a repeated page (#...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/9dd722fd0b533b3cb44cd2834409f7ea4dd32b00";><code>9dd722f</code></a> fix(core): await the notification send so a failed send is never briefly unha...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e780e13869ad419a864b669bd5fa9702cfb36b14";><code>e780e13</code></a> fix(client): preserve _meta on input_required results (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2862";>#2862</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a4ae2f98da3814a9290f2791cfcca8148dcec978";><code>a4ae2f9</code></a> docs(client): correct the registerClient deprecation citation to spec PR <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/285";>#285</a>...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/efebf5b2ba2f07c6fa27ada824a0999b801fec0a";><code>efebf5b</code></a> docs(client): correct token endpoint TLS citation (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2768";>#2768</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/d992df724723c30305a573a5087c2743d23acd9f";><code>d992df7</code></a> chore: remove CODEOWNERS patterns that match nothing on main (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2884";>#2884</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c0f7aec2925a46b32dc2f2aad5bf636a36f02c78";><code>c0f7aec</code></a> fix(client): inline jose types in the CommonJS declaration file (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2883";>#2883</a>)</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/[email protected]...@modelcontextprotocol/[email protected]";>compare view</a></li> </ul> </details> <br /> Updates `@modelcontextprotocol/inspector` from 2.6.0 to 2.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/inspector/releases";>@modelcontextprotocol/inspector's releases</a>.</em></p> <blockquote> <h2>2.9.0</h2> <h2>What's Changed</h2> <ul> <li>docs(pr-flow): make an exhaustive Copilot review loop the step after opening a PR by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2466";>modelcontextprotocol/inspector#2466</a></li> <li>docs(pr-flow): assign the issue to yourself when work starts by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2468";>modelcontextprotocol/inspector#2468</a></li> <li>fix(skills): require ttlMs and cacheScope on modern skills/get results by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2469";>modelcontextprotocol/inspector#2469</a></li> <li>fix(skills): report a "dynamic" skill as unverifiable, not verified by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2474";>modelcontextprotocol/inspector#2474</a></li> <li>fix(web): mask the tail of a form secret split by a raw & by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2475";>modelcontextprotocol/inspector#2475</a></li> <li>fix(gate-lease): serve queued local:gate runs in arrival order by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2476";>modelcontextprotocol/inspector#2476</a></li> <li>fix(core): advertise the MCP Apps UI extension only from a client that renders Apps by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2471";>modelcontextprotocol/inspector#2471</a></li> <li>fix(remote): re-arm relay waits for string progress tokens by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2478";>modelcontextprotocol/inspector#2478</a></li> <li>fix(cli): end the long-lived stream cleanly on EPIPE by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2479";>modelcontextprotocol/inspector#2479</a></li> <li>docs(skills): get Copilot's testing → test-servers hand-off to 100% (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2459";>#2459</a>) by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2477";>modelcontextprotocol/inspector#2477</a></li> <li>fix(tui): cap rendered request/response body lines by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2480";>modelcontextprotocol/inspector#2480</a></li> <li>docs(pr-flow): make the In Progress / In Review card moves runnable, with a check by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2472";>modelcontextprotocol/inspector#2472</a></li> <li>docs(pr-flow): read the issue and all its comments before starting work by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2491";>modelcontextprotocol/inspector#2491</a></li> <li>fix(cli): redact URL query secrets in the error envelope by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2488";>modelcontextprotocol/inspector#2488</a></li> <li>chore(smoke): run smoke:tui for real in GitHub CI by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2489";>modelcontextprotocol/inspector#2489</a></li> <li>chore(deps): upgrade the MCP TypeScript SDK to 2.1.0 by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2492";>modelcontextprotocol/inspector#2492</a></li> <li>fix(web): prompt a reconnect when custom headers change on a live connection by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2493";>modelcontextprotocol/inspector#2493</a></li> <li>chore(scripts): fail fast when node_modules is older than its lockfile by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2495";>modelcontextprotocol/inspector#2495</a></li> <li>fix(cli): bound the OAuth browser open and say when it fails by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2499";>modelcontextprotocol/inspector#2499</a></li> <li>chore(tui): justify every exhaustive-deps suppression by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2500";>modelcontextprotocol/inspector#2500</a></li> <li>test(launcher,cli): assert Windows backslash paths survive argv forwarding by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2501";>modelcontextprotocol/inspector#2501</a></li> <li>fix(core): enforce one deadline per RequestInit in withOAuthRequestTimeout by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2503";>modelcontextprotocol/inspector#2503</a></li> <li>fix(docker): derive the HEALTHCHECK probe address from HOST by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2504";>modelcontextprotocol/inspector#2504</a></li> <li>chore(smoke): surface the app's connect error on a connect timeout by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2505";>modelcontextprotocol/inspector#2505</a></li> <li>fix(scripts): fail the Dependabot sweep clearly on a bad alert listing by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2502";>modelcontextprotocol/inspector#2502</a></li> <li>fix(auth): pin the AES-GCM auth tag length in FileSecretStore by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2509";>modelcontextprotocol/inspector#2509</a></li> <li>ci: split the npm release job so install scripts never hold the OIDC token by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2506";>modelcontextprotocol/inspector#2506</a></li> <li>fix(web): report the Inspector version as clientInfo.version by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2511";>modelcontextprotocol/inspector#2511</a></li> <li>test: stop the useServers render loop and guard against its return by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2513";>modelcontextprotocol/inspector#2513</a></li> <li>fix(docker): skip the web healthcheck probe under --cli/--tui by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2510";>modelcontextprotocol/inspector#2510</a></li> <li>test(web): configure React's act environment and wrap the updates it exposes by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2514";>modelcontextprotocol/inspector#2514</a></li> <li>SHA-pin the actions in credential-holding workflow jobs by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2512";>modelcontextprotocol/inspector#2512</a></li> <li>feat(auth): store acquired OAuth tokens in the secret store; clobber-safe oauth.json writes by <a href="https://github.com/BobDickinson";><code>@BobDickinson</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2482";>modelcontextprotocol/inspector#2482</a></li> <li>docs: add MCP Inspector: Our AI Software Factory by <a href="https://github.com/BobDickinson";><code>@BobDickinson</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2498";>modelcontextprotocol/inspector#2498</a></li> <li>fix(deps): make <code>@modelcontextprotocol/server-legacy</code> a devDependency by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2520";>modelcontextprotocol/inspector#2520</a></li> <li>chore(deps): upgrade the MCP TypeScript SDK to 2.2.0 by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2526";>modelcontextprotocol/inspector#2526</a></li> <li>chore(deps): upgrade the MCP Apps extension SDK to 2.0.3 by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2527";>modelcontextprotocol/inspector#2527</a></li> <li>chore(release): npm audit fixes and bump version to 2.9.0 by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2529";>modelcontextprotocol/inspector#2529</a></li> <li>fix(cli): catch an opener that cannot be spawned instead of crashing by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2534";>modelcontextprotocol/inspector#2534</a></li> <li>fix(core): redact a form secret's raw-& tail in recorded bodies by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2535";>modelcontextprotocol/inspector#2535</a></li> <li>fix(cli): split trailing punctuation off redacted URLs in linear time by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2541";>modelcontextprotocol/inspector#2541</a></li> <li>chore(release): merge v2/main into main for v2.9.0 by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2536";>modelcontextprotocol/inspector#2536</a></li> <li>fix(ci): publish the tarball by a ./ path so npm reads it as a file by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2552";>modelcontextprotocol/inspector#2552</a></li> <li>chore(release): merge v2/main into main for the v2.9.0 re-release (publish fix) by <a href="https://github.com/cliffhall";><code>@cliffhall</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/inspector/pull/2553";>modelcontextprotocol/inspector#2553</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/inspector/compare/2.8.0...2.9.0";>https://github.com/modelcontextprotocol/inspector/compare/2.8.0...2.9.0</a> <strong>Smoke test ledger for milestone branch</strong>: <a href="https://claude.ai/artifact/3cWteCtohesQrCSgujccvn";>v2/chore/milestone-merge-v2.9.0</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/ae865a19178ddf6f375780a02e9c77c4cf4da184";><code>ae865a1</code></a> Merge pull request <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2553";>#2553</a> from modelcontextprotocol/v2/chore/milestone-merge-v...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/6858a0f635bb1e209aea547f24cd4772472ec3c3";><code>6858a0f</code></a> chore: merge v2/main into main for the v2.9.0 re-release (publish fix <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2551";>#2551</a>)</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/8996cc45f51a1a105dbf5196fd59e2d88bacc554";><code>8996cc4</code></a> Merge pull request <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2552";>#2552</a> from modelcontextprotocol/v2/fix/2551-publish-local-...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/773f9b9ea89cad457b0de644cc87304b0762e32a";><code>773f9b9</code></a> fix(ci): publish the tarball by a ./ path so npm reads it as a file</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/e0e2cb59e12fa7f02ba8e1c1b3563bf90270a75d";><code>e0e2cb5</code></a> Merge pull request <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2536";>#2536</a> from modelcontextprotocol/v2/chore/milestone-merge-v...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/87bb185e3ef2ce01732597654bdd01c71f61de70";><code>87bb185</code></a> chore: merge v2/main into main for the v2.9.0 release</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/7e606f5cff8fb0e8872edb1d1c323b5465465b28";><code>7e606f5</code></a> Merge pull request <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2541";>#2541</a> from modelcontextprotocol/v2/fix/2540-linear-trailin...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/66dae5c2f0b5581c60b4a36f41ca14abca3c7142";><code>66dae5c</code></a> fix(cli): split trailing punctuation off redacted URLs in linear time</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/36f3d8198874abc29b7eeef14b8dc63cbc4c29d1";><code>36f3d81</code></a> chore: merge v2/main into main for the v2.9.0 release</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/df9d348ccb6d04311d55c509acde485850d78f36";><code>df9d348</code></a> Merge pull request <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/2535";>#2535</a> from modelcontextprotocol/v2/fix/2532-redactbody-raw...</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/inspector/compare/2.6.0...2.9.0";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/echarts-mcp/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
