diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 93fe874e..c31b0f51 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,3 +13,17 @@ updates: groups: github-actions: patterns: ["*"] + + # Without this, runtime and dev dependencies only move when someone bumps + # them by hand, so they drift past security advisories. Minor and patch + # bumps share one weekly PR; each major still gets its own. + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + commit-message: + prefix: chore(deps) + groups: + npm-minor-and-patch: + patterns: ["*"] + update-types: ["minor", "patch"] diff --git a/package.json b/package.json index a7abfd03..09e3016f 100644 --- a/package.json +++ b/package.json @@ -71,10 +71,10 @@ "@agent-device/proxy": "0.21.28", "@hono/node-server": "2.0.10", "@hono/zod-openapi": "1.6.3", - "@modelcontextprotocol/sdk": "1.29.0", - "hono": "^4.13.5", + "@modelcontextprotocol/sdk": "1.32.1", + "hono": "^4.13.13", "jose": "6.2.9", - "ws": "8.18.3", + "ws": "8.22.0", "zod": "^4.6.5" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 755ab3db..aa56e1f3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -218,22 +218,22 @@ importers: version: 0.21.28 '@hono/node-server': specifier: 2.0.10 - version: 2.0.10(hono@4.13.5) + version: 2.0.10(hono@4.13.13) '@hono/zod-openapi': specifier: 1.6.3 - version: 1.6.3(hono@4.13.5)(zod@4.6.5) + version: 1.6.3(hono@4.13.13)(zod@4.6.5) '@modelcontextprotocol/sdk': - specifier: 1.29.0 - version: 1.29.0(supports-color@7.2.0)(zod@4.6.5) + specifier: 1.32.1 + version: 1.32.1(supports-color@7.2.0)(zod@4.6.5) hono: - specifier: ^4.13.5 - version: 4.13.5 + specifier: ^4.13.13 + version: 4.13.13 jose: specifier: 6.2.9 version: 6.2.9 ws: - specifier: 8.18.3 - version: 8.18.3 + specifier: 8.22.0 + version: 8.22.0 zod: specifier: ^4.6.5 version: 4.6.5 @@ -813,8 +813,8 @@ packages: '@keyv/serialize@1.1.1': resolution: {integrity: sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==} - '@modelcontextprotocol/sdk@1.29.0': - resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==} + '@modelcontextprotocol/sdk@1.32.1': + resolution: {integrity: sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -2195,8 +2195,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2331,8 +2331,8 @@ packages: resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} engines: {node: '>= 0.4'} - hono@4.13.5: - resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==} + hono@4.13.13: + resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} engines: {node: '>=16.9.0'} http-cache-semantics@4.3.0: @@ -2401,8 +2401,8 @@ packages: resolution: {integrity: sha512-6xwYfHbajpoF0xLW+iwLkhwgvLoZDfjYfoFNu8ftMoXINzwuymNLd9u/KmwtdT2GbR+/Cz66otEGEVVUHX9QLQ==} engines: {node: '>=10.13.0'} - ip-address@10.5.0: - resolution: {integrity: sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==} + ip-address@10.7.4: + resolution: {integrity: sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -3047,8 +3047,8 @@ packages: resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==} engines: {node: '>= 6'} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} pump@2.0.1: @@ -3061,10 +3061,6 @@ packages: resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==} engines: {node: '>=0.6'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} - engines: {node: '>=0.6'} - qs@6.16.1: resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} @@ -3678,8 +3674,8 @@ packages: wrappy@1.0.2: resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==} - ws@8.18.3: - resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==} + ws@8.22.0: + resolution: {integrity: sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -4005,7 +4001,7 @@ snapshots: json-stringify-safe: 5.0.1 mime-types: 2.1.35 performance-now: 2.1.0 - qs: 6.15.3 + qs: 6.16.1 safe-buffer: 5.2.1 tough-cookie: 5.1.2 tunnel-agent: 0.6.0 @@ -4055,21 +4051,21 @@ snapshots: '@fontsource-variable/geist@5.3.0': {} - '@hono/node-server@2.0.10(hono@4.13.5)': + '@hono/node-server@2.0.10(hono@4.13.13)': dependencies: - hono: 4.13.5 + hono: 4.13.13 - '@hono/zod-openapi@1.6.3(hono@4.13.5)(zod@4.6.5)': + '@hono/zod-openapi@1.6.3(hono@4.13.13)(zod@4.6.5)': dependencies: '@asteasolutions/zod-to-openapi': 9.1.0(zod@4.6.5) - '@hono/zod-validator': 0.9.1(hono@4.13.5)(zod@4.6.5) - hono: 4.13.5 + '@hono/zod-validator': 0.9.1(hono@4.13.13)(zod@4.6.5) + hono: 4.13.13 openapi3-ts: 4.6.2 zod: 4.6.5 - '@hono/zod-validator@0.9.1(hono@4.13.5)(zod@4.6.5)': + '@hono/zod-validator@0.9.1(hono@4.13.13)(zod@4.6.5)': dependencies: - hono: 4.13.5 + hono: 4.13.13 zod: 4.6.5 '@humanwhocodes/momoa@2.0.4': {} @@ -4211,9 +4207,9 @@ snapshots: '@keyv/serialize@1.1.1': {} - '@modelcontextprotocol/sdk@1.29.0(supports-color@7.2.0)(zod@4.6.5)': + '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@4.6.5)': dependencies: - '@hono/node-server': 2.0.10(hono@4.13.5) + '@hono/node-server': 2.0.10(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -4223,7 +4219,7 @@ snapshots: eventsource-parser: 3.1.1 express: 5.2.1(supports-color@7.2.0) express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0) - hono: 4.13.5 + hono: 4.13.13 jose: 6.2.9 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -4930,7 +4926,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -5038,7 +5034,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -5408,7 +5404,7 @@ snapshots: dependencies: debug: 4.4.3(supports-color@7.2.0) express: 5.2.1(supports-color@7.2.0) - ip-address: 10.5.0 + ip-address: 10.7.4 transitivePeerDependencies: - supports-color @@ -5434,7 +5430,7 @@ snapshots: on-finished: 2.4.1 parseurl: 1.3.3 path-to-regexp: 0.1.13 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.16.1 range-parser: 1.2.1 safe-buffer: 5.2.1 @@ -5469,8 +5465,8 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 - qs: 6.15.3 + proxy-addr: 2.0.8 + qs: 6.16.1 range-parser: 1.3.0 router: 2.2.0(supports-color@7.2.0) send: 1.2.1(supports-color@7.2.0) @@ -5516,7 +5512,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.5: {} + fast-uri@3.1.9: {} fast-wrap-ansi@0.2.2: dependencies: @@ -5681,7 +5677,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.13.5: {} + hono@4.13.13: {} http-cache-semantics@4.3.0: {} @@ -5741,7 +5737,7 @@ snapshots: interpret@3.1.1: {} - ip-address@10.5.0: {} + ip-address@10.7.4: {} ipaddr.js@1.9.1: {} @@ -6250,7 +6246,7 @@ snapshots: kleur: 3.0.3 sisteransi: 1.0.5 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -6270,11 +6266,6 @@ snapshots: dependencies: side-channel: 1.1.1 - qs@6.15.3: - dependencies: - es-define-property: 1.0.1 - side-channel: 1.1.1 - qs@6.16.1: dependencies: es-define-property: 1.0.1 @@ -6961,7 +6952,7 @@ snapshots: wrappy@1.0.2: {} - ws@8.18.3: {} + ws@8.22.0: {} xtend@4.0.2: {}