chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the npm-minor-patch group with 6 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	1.29.0	1.30.0
@noble/ciphers	2.2.0	2.3.0
pg	8.21.0	8.23.0
@types/pg	8.20.0	8.21.0
picomatch	4.0.4	4.0.5
ws	8.20.1	8.21.3

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in modelcontextprotocol/typescript-sdk#1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in modelcontextprotocol/typescript-sdk#1839
• Add end-to-end test suite by @​felixweinberger in modelcontextprotocol/typescript-sdk#2167
• v1 stdio buffer limit by @​KKonstantinov in modelcontextprotocol/typescript-sdk#2239
• fix: support Zod 3.25 method literals by @​mattzcarey in modelcontextprotocol/typescript-sdk#2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in modelcontextprotocol/typescript-sdk#2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in modelcontextprotocol/typescript-sdk#2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2547
• chore: bump version to 1.30.0 by @​felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

• @​mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503
• @​arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

• 2d889f2 chore: bump version to 1.30.0 (#2563)
• e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
• bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
• 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
• 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
• 369513d fix: support Zod 3.25 method literals (#2368)
• e7ee57c v1 stdio buffer limit (#2239)
• c36e1ef Add end-to-end test suite (#2167)
• bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
• 9edbab7 fix(server): prioritize zod issues and format them (#1503)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.

Updates @noble/ciphers from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/ciphers's releases.

2.3.0

Hardening

• AEAD strictness: passing AAD to a cipher that doesn't support it now throws AAD not supported instead of silently ignoring it. Applies to both native ciphers and the webcrypto wrappers via a new withAAD cipher param.
• CBC/ECB padding failures now surface as a generic aes: bad decrypt instead of a padding-specific message, reducing padding-oracle signal.
• FF1: minLen now enforces the NIST SP 800-38G minimum of 2 in addition to radix**minlen >= 100; stricter radix encoding guards.
• Correctness fixes for big-endian CPUs (polyval tag normalization, AES CTR partial-block tails).
• Other minor corrections
• Reduce on-disk package size: 710kb → 531kb (-179kb), by disabling source maps (they became less relevant).

Boost AES-SIV speed by 20%

Full Changelog: paulmillr/noble-ciphers@2.2.0...2.3.0

Commits

• c9b7ed1 Release 2.3.0.
• fbcaafc Minor updates
• 14efae5 ci: limit branch
• efad32b Update jsbt
• 79bcfc5 Test: use new syntax
• ebeb760 Make utils similar to other noble packages
• 72d4dea readme
• 86cee50 Shorten errors, reduces bundle size
• 09b44f4 Bugfixes, treeshaking improvements. Move out micro to test/misc.
• 00044cd Fix typos in README.md (#73)
• Additional commits viewable in compare view

Updates pg from 8.21.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

• Add support for query pipelineing.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

Commits

• df274d1 Publish
• eb19d0f Add opt-in query pipelining (#3652)
• b617619 Publish
• d80b261 Update docs & changelog
• 835fb83 Fix error handling for exceptions on values parsing. (#3574)
• f49ab4a fix: correct spelling mistakes across codebase (#3692)
• d7175a4 Expand CI matrix of PG versions and add direct SSL test (#3693)
• 882fc30 Add support for sslnegotiation=direct (PostgreSQL 17) (#3688)
• See full diff in compare view

Updates @types/pg from 8.20.0 to 8.21.0

Commits

• See full diff in compare view

Updates picomatch from 4.0.4 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

• fix: preserve all branches when rewriting risky repeated extglobs by @​MerlijnW70 in micromatch/picomatch#182
• fix: honor the windows option when matching basenames by @​MerlijnW70 in micromatch/picomatch#183

New Contributors

• @​MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

Commits

• 4f41a8e 4.0.5
• 02cfc1b Update .verb.md and run verb to generate README documentation
• cc52ff6 Only run the upload code coverage step for 1 matrix permutation
• 6d426d7 Allow workflow to continue if the code coverage step to fails
• a00b954 Merge branch 'codeql-coverage'
• 9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
• 648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
• 70e6485 Configure code coverage upload for CodeQL
• ab8bc4d fix: honor the windows option when matching basenames
• 6289307 fix: preserve all branches when rewriting risky repeated extglobs
• Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates @types/pg from 8.20.0 to 8.21.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions