VersionControl:PRs/pickipedia-mcp/46

pickipedia-mcp#46: Bump @modelcontextprotocol/node from 2.0.0 to 2.1.2

State	🟢 open
Worked on by	not said
Moods	not said
Deploy	not said
Branch	dependabot/npm_and_yarn/modelcontextprotocol/node-2.1.2 → master, by dependabot[bot]
Opened · last pushed	2026-11-01 13:55:50 · 2026-11-01 13:55:48

Bumps [@modelcontextprotocol/node](https://github.com/modelcontextprotocol/typescript-sdk) from 2.0.0 to 2.1.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/node's releases</a>.</em></p>
<blockquote>
<h2><code>@​modelcontextprotocol/node</code><a href="https://github.com/2"><code>@​2</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3084">#3084</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/10c26b00cb9c6d12332a92ea02f75530452450e4"><code>10c26b0</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - The <code>@hono/node-server</code> dependency range widens from <code>^1.19.9</code> to <code>^1.19.9 || ^2.1.3</code>, so a new install resolves to 2.x and an install that cannot get 2.x keeps 1.x.</p>
</li>
<li>
<p>Updated dependencies [<a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c05225a636c679870b65f8ca4fe83a76ea1cf113"><code>c05225a</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/43c45f4941d824e7251a7d1266823a84af90fab3"><code>43c45f4</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5820f796a48ae6b8e756a7fbfd627e7e2e1ac891"><code>5820f79</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c05225a636c679870b65f8ca4fe83a76ea1cf113"><code>c05225a</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b381559edc0dbe25ab8324cada345b49bd1d2fc4"><code>b381559</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/895007fe728b9c57fbe3ed45fe279ddc51f731f7"><code>895007f</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b022522089a0c8b632595c6e7b536453945ed5a9"><code>b022522</code></a>]:</p>
<ul>
<li><code>@​modelcontextprotocol/server</code><a href="https://github.com/2"><code>@​2</code></a>.4.0</li>
</ul>
</li>
</ul>
<h2><code>@​modelcontextprotocol/node</code><a href="https://github.com/2"><code>@​2</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2897">#2897</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/7f4c12a6ae6b8f22411f7772c88036e1c8055423"><code>7f4c12a</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - <code>hono</code> is now a regular dependency of <code>@modelcontextprotocol/node</code>, so installs with strict peer-dependency checking no longer fail on the <code>hono</code> peer that <code>@hono/node-server</code> requires. No runtime change.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2918">#2918</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"><code>84804c2</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - A <code>Server</code> or <code>McpServer</code> now serves one connection at a time, and a Streamable HTTP server transport without sessions (<code>sessionIdGenerator: undefined</code>) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.</p>
<p>What keeps working without a change:</p>
<ul>
<li><code>createMcpHandler(buildServer)</code> and <code>serveStdio(buildServer)</code>, where <code>buildServer</code> returns a new server on every call.</li>
<li>A handler that builds a new server and a new stateless transport for each request.</li>
<li>One server and one transport per session (a transport with a <code>sessionIdGenerator</code>).</li>
<li>Connecting a server again after <code>close()</code>.</li>
<li><code>Client</code>.</li>
</ul>
<p>What fails now, how it shows, and what to change:</p>
<ul>
<li>One server object with a new stateless transport per request (<code>const server = new McpServer(...)</code> outside the handler, <code>await server.connect(transport)</code> inside it): the second HTTP request the process receives fails, and so does every later one. <code>connect()</code> rejects with an <code>SdkError</code> of code <code>ALREADY_CONNECTED</code>. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move <code>new McpServer(...)</code> and its registrations into the handler.</li>
<li>One stateless transport for every request (a transport built once with <code>sessionIdGenerator: undefined</code>): the second HTTP request fails. <code>WebStandardStreamableHTTPServerTransport.handleRequest()</code> rejects with <code>Stateless transport cannot be reused across requests. Create a new transport per request.</code>, and <code>NodeStreamableHTTPServerTransport.handleRequest()</code> answers <code>500</code>. Change: build the server and the transport inside the handler and connect them there.</li>
<li><code>createMcpHandler(() =&gt; server)</code> with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered <code>500</code> with the JSON-RPC error <code>-32603</code> (<code>Internal server error</code>); the reason is reported only through the <code>onerror</code> option. Change: pass a function that builds the server, as in <code>createMcpHandler(buildServer)</code>.</li>
<li>One server object for every session: the <code>initialize</code> request of the second session fails with <code>ALREADY_CONNECTED</code>. Change: build a server per session.</li>
</ul>
<p>What the caller sees when <code>connect()</code> or <code>handleRequest()</code> rejects depends on the host. Express 5, Fastify and Hono answer <code>500</code>. A plain <code>node:http</code> listener without its own error handling gets an unhandled rejection, which ends the process.</p>
<p>The README examples of <code>@modelcontextprotocol/express</code>, <code>@modelcontextprotocol/fastify</code>, <code>@modelcontextprotocol/hono</code> and <code>@modelcontextprotocol/node</code>, and the handler examples in the JSDoc of <code>WebStandardStreamableHTTPServerTransport</code> and <code>NodeStreamableHTTPServerTransport</code>, now build a server and a transport per request.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2908">#2908</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1"><code>633dd3e</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - The <code>license</code> field of the package manifests is now <code>Apache-2.0</code>; the <code>LICENSE</code> file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.</p>
</li>
<li>
<p>Updated dependencies [<a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"><code>40f8f4e</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"><code>6d8dbc6</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5238fba4424f82ec1ae9f6f458dd655ab322062d"><code>5238fba</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2fc49eaf17a6b9ac0810c875cc96d3b949f9522c"><code>2fc49ea</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/4d94e7b1ccf769d94a7bbba7789f1ee6c7dfdd8c"><code>4d94e7b</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"><code>84804c2</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e55f9ac1b1cae413599b499cbaa45c0378edba78"><code>e55f9ac</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1"><code>633dd3e</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2237555ed036c3e80341c0f3c28684e9c3ff0728"><code>2237555</code></a>]:</p>
<ul>
<li><code>@​modelcontextprotocol/server</code><a href="https://github.com/2"><code>@​2</code></a>.3.0</li>
</ul>
</li>
</ul>
<h2><code>@​modelcontextprotocol/node</code><a href="https://github.com/2"><code>@​2</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1624">#1624</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/60321700871029401a2e3bed8fdf4f02c9ec3331"><code>6032170</code></a> Thanks <a href="https://github.com/SamMorrowDrums"><code>@​SamMorrowDrums</code></a>! - Add request-time OAuth scope challenges for tools, resources, resource templates,
and prompts. Each primitive's <code>scopeChallenge</code> callback receives the parsed
request and verified authentication info, then either continues or returns the
exact scope set for an <code>insufficient_scope</code> response. <code>requireScopes</code> provides a
small helper for static all-of checks.</p>
<p><code>createMcpHandler</code> and Streamable HTTP transports return HTTP 403 with an
<code>insufficient_scope</code> challenge before handler execution or SSE setup. The
preflight is active whenever a registered primitive carries a <code>scopeChallenge</code>
callback — there is no handler- or transport-level configuration. The</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/951fe5603a7ec0b2dcb6a0b95d92cd86f93ad9e5"><code>951fe56</code></a> Version Packages (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2959">#2959</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/895007fe728b9c57fbe3ed45fe279ddc51f731f7"><code>895007f</code></a> fix(server): set Allow: POST on stateless legacy 405 responses (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3002">#3002</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/28124dbb57594be1ca25e85122066d1e5d4535b5"><code>28124db</code></a> fix(docs): use relative POSIX package entry globs (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3016">#3016</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/f7289b3531cdd7d8487663ca437496c1dfe0fe05"><code>f7289b3</code></a> docs: say that a spec handler's params drop members the spec does not define ...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a63375661399956a744ff8b34d03d36e3d09e98a"><code>a633756</code></a> feat(client): add an opt-in for sending scope on token refresh (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3085">#3085</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/10c26b00cb9c6d12332a92ea02f75530452450e4"><code>10c26b0</code></a> chore(node): accept <code>@​hono/node-server</code> 1.x or 2.x (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3084">#3084</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a> chore(deps): build the bundled ajv with fast-uri 3.1.8 (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3083">#3083</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5820f796a48ae6b8e756a7fbfd627e7e2e1ac891"><code>5820f79</code></a> fix(server): treat an outputSchema root $ref to an object definition as an ob...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a513cfecff33d6a34469854d331fa0cc84e208d4"><code>a513cfe</code></a> docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3086">#3086</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c822443f270fbec2f15d36dcced45bd7e8556f2e"><code>c822443</code></a> docs(server): mark SkillsExtension.attach as experimental (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3080">#3080</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/node@2.0.0...@modelcontextprotocol/node@2.1.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@modelcontextprotocol/node&package-manager=npm_and_yarn&previous-version=2.0.0&new-version=2.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>