VersionControl:PRs/pickipedia-mcp/48

pickipedia-mcp#48: Bump @modelcontextprotocol/express from 2.0.0 to 2.0.2

State	🟢 open
Worked on by	not said
Moods	not said
Deploy	not said
Branch	dependabot/npm_and_yarn/modelcontextprotocol/express-2.0.2 → master, by dependabot[bot]
Opened · last pushed	2026-11-01 13:56:05 · 2026-11-01 13:56:03

Bumps [@modelcontextprotocol/express](https://github.com/modelcontextprotocol/typescript-sdk) from 2.0.0 to 2.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/express's releases</a>.</em></p>
<blockquote>
<h2><code>@​modelcontextprotocol/express</code><a href="https://github.com/2"><code>@​2</code></a>.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2929">#2929</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"><code>40f8f4e</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - <code>requireBearerAuth</code> and <code>verifyBearerToken</code> take a new optional <code>expectedResource</code>, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in <code>AuthInfo.resource</code>; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered <code>401 invalid_token</code> with the usual <code>WWW-Authenticate</code> challenge. When it is not set, nothing changes. To use it, pass <code>expectedResource</code> and have <code>verifyAccessToken</code> fill <code>AuthInfo.resource</code>, for example from the <code>aud</code> claim. The option is declared on a new exported type, <code>VerifyBearerTokenOptions</code>, which extends <code>BearerAuthOptions</code>; <code>BearerAuthOptions</code> itself is unchanged. The Express <code>requireBearerAuth</code> passes the option through. With Express, <code>@modelcontextprotocol/express</code> has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an <code>expectedResource</code> written in a call to the 2.0.1 <code>requireBearerAuth</code> as an error.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2918">#2918</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"><code>84804c2</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - A <code>Server</code> or <code>McpServer</code> now serves one connection at a time, and a Streamable HTTP server transport without sessions (<code>sessionIdGenerator: undefined</code>) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.</p>
<p>What keeps working without a change:</p>
<ul>
<li><code>createMcpHandler(buildServer)</code> and <code>serveStdio(buildServer)</code>, where <code>buildServer</code> returns a new server on every call.</li>
<li>A handler that builds a new server and a new stateless transport for each request.</li>
<li>One server and one transport per session (a transport with a <code>sessionIdGenerator</code>).</li>
<li>Connecting a server again after <code>close()</code>.</li>
<li><code>Client</code>.</li>
</ul>
<p>What fails now, how it shows, and what to change:</p>
<ul>
<li>One server object with a new stateless transport per request (<code>const server = new McpServer(...)</code> outside the handler, <code>await server.connect(transport)</code> inside it): the second HTTP request the process receives fails, and so does every later one. <code>connect()</code> rejects with an <code>SdkError</code> of code <code>ALREADY_CONNECTED</code>. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move <code>new McpServer(...)</code> and its registrations into the handler.</li>
<li>One stateless transport for every request (a transport built once with <code>sessionIdGenerator: undefined</code>): the second HTTP request fails. <code>WebStandardStreamableHTTPServerTransport.handleRequest()</code> rejects with <code>Stateless transport cannot be reused across requests. Create a new transport per request.</code>, and <code>NodeStreamableHTTPServerTransport.handleRequest()</code> answers <code>500</code>. Change: build the server and the transport inside the handler and connect them there.</li>
<li><code>createMcpHandler(() =&gt; server)</code> with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered <code>500</code> with the JSON-RPC error <code>-32603</code> (<code>Internal server error</code>); the reason is reported only through the <code>onerror</code> option. Change: pass a function that builds the server, as in <code>createMcpHandler(buildServer)</code>.</li>
<li>One server object for every session: the <code>initialize</code> request of the second session fails with <code>ALREADY_CONNECTED</code>. Change: build a server per session.</li>
</ul>
<p>What the caller sees when <code>connect()</code> or <code>handleRequest()</code> rejects depends on the host. Express 5, Fastify and Hono answer <code>500</code>. A plain <code>node:http</code> listener without its own error handling gets an unhandled rejection, which ends the process.</p>
<p>The README examples of <code>@modelcontextprotocol/express</code>, <code>@modelcontextprotocol/fastify</code>, <code>@modelcontextprotocol/hono</code> and <code>@modelcontextprotocol/node</code>, and the handler examples in the JSDoc of <code>WebStandardStreamableHTTPServerTransport</code> and <code>NodeStreamableHTTPServerTransport</code>, now build a server and a transport per request.</p>
</li>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2908">#2908</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1"><code>633dd3e</code></a> Thanks <a href="https://github.com/apps/claude"><code>@​claude</code></a>! - The <code>license</code> field of the package manifests is now <code>Apache-2.0</code>; the <code>LICENSE</code> file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.</p>
</li>
<li>
<p>Updated dependencies [<a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"><code>40f8f4e</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"><code>6d8dbc6</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5238fba4424f82ec1ae9f6f458dd655ab322062d"><code>5238fba</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2fc49eaf17a6b9ac0810c875cc96d3b949f9522c"><code>2fc49ea</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/4d94e7b1ccf769d94a7bbba7789f1ee6c7dfdd8c"><code>4d94e7b</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"><code>84804c2</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e55f9ac1b1cae413599b499cbaa45c0378edba78"><code>e55f9ac</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1"><code>633dd3e</code></a>, <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2237555ed036c3e80341c0f3c28684e9c3ff0728"><code>2237555</code></a>]:</p>
<ul>
<li><code>@​modelcontextprotocol/server</code><a href="https://github.com/2"><code>@​2</code></a>.3.0</li>
</ul>
</li>
</ul>
<h2><code>@​modelcontextprotocol/express</code><a href="https://github.com/2"><code>@​2</code></a>.0.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2698">#2698</a> <a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/7b781ed4e25355a25d15974f3c76de81299694ed"><code>7b781ed</code></a> Thanks <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a>! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read —
<code>WebStandardStreamableHTTPServerTransport</code> (and the Node transport built on it),
<code>createMcpHandler</code>, <code>toNodeHandler</code>, and <code>createMcpHonoApp</code>'s JSON pre-parse — now stops at
4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio
bound their reads too) and answers <code>413 Payload Too Large</code> before anything is parsed.
<code>toWebRequest</code> (when it reads the Node stream itself) now rejects once the body exceeds the
limit with an error whose <code>name</code> is <code>'RequestBodyTooLargeError'</code> and <code>status</code> is <code>413</code>, and
<code>toNodeHandler</code> answers that with <code>413</code>; hand-wired callers of <code>toWebRequest</code> should handle the
rejection or pass a pre-parsed body, and <code>isLegacyRequest</code> reports such a request as non-legacy
so the modern handler answers it. JSON-RPC batch arrays are limited to 100 messages; a longer
batch is answered <code>400</code> / <code>-32600</code> and none of it is dispatched.</p>
<p>The limit is configurable with a new <code>maxRequestBodySize</code> option (bytes, default
<code>DEFAULT_MAX_REQUEST_BODY_SIZE</code> = 4 MiB, exported from <code>@modelcontextprotocol/server</code>) on
<code>WebStandardStreamableHTTPServerTransportOptions</code>, <code>CreateMcpHandlerOptions</code> (forwarded to its
stateless legacy leg; <code>isLegacyRequest</code> and <code>legacyStatelessFallback</code> take the same option),
<code>CreateMcpHonoAppOptions</code>, and <code>ToNodeHandlerOptions</code> / <code>ToWebRequestOptions</code> (the adapter's
bound applies before the handler's, so raise both). The bounded reader is exported as</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a202a3621fcb97918e09fa45d0f9efd2dbdee19b"><code>a202a36</code></a> Version Packages (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2896">#2896</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d731faef167b3df78d4be05f547a134f0e23bcf"><code>2d731fa</code></a> fix(client): refresh again when an SSE retry failed for a reason other than 4...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b6e5c5574e107c33cb6ae33c2e869780f5684c3a"><code>b6e5c55</code></a> test(e2e): cover prompts/get without arguments for prompts with a schema (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2928">#2928</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"><code>40f8f4e</code></a> feat(server): add expectedResource to the bearer-token check (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2929">#2929</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"><code>6d8dbc6</code></a> feat(server): add maxToolInputElements option to limit the number of elements...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2fc49eaf17a6b9ac0810c875cc96d3b949f9522c"><code>2fc49ea</code></a> fix(server): accept prompts/get requests that omit arguments (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2107">#2107</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/63c0fcab49dc13f22dd7d016d6320c62d05e3ca8"><code>63c0fca</code></a> fix(client): update eventsource-parser for large SSE responses (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2846">#2846</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"><code>84804c2</code></a> fix(server): refuse a second connect and stateless transport reuse (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2918">#2918</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e16d27729ea2fae144a6d957fd0372d9eb0e6c58"><code>e16d277</code></a> docs: close idle sessions and cap the session map in the sessions guide and e...</li>
<li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"><code>433eb41</code></a> fix(client): follow redirects only within the origin of the request (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2901">#2901</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/express@2.0.0...@modelcontextprotocol/express@2.0.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@modelcontextprotocol/express&package-manager=npm_and_yarn&previous-version=2.0.0&new-version=2.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>