chore(deps): update @ai-sdk/mcp to v2 - #411
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough
Estimated code review effort: 1 (Trivial) | ~2 minutes Mergeability Score: ⚪ Minimal · up to This dependency update introduces no supported merge-blocking risk at the current head and is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #411 +/- ##
=======================================
Coverage 88.30% 88.30%
=======================================
Files 191 191
Lines 10697 10697
Branches 3079 3079
=======================================
Hits 9446 9446
Misses 1249 1249
Partials 2 2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
9439d07 to
69d302e
Compare
69d302e to
1d894b8
Compare
1d894b8 to
cb782f5
Compare
cb782f5 to
5f19fe2
Compare
5f19fe2 to
80a36b2
Compare
80a36b2 to
4443532
Compare
4443532 to
8ba7fa9
Compare
8ba7fa9 to
40b9734
Compare
40b9734 to
07637fb
Compare
07637fb to
fe24667
Compare
c35cd84 to
bb390b5
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
bb390b5 to
2635a17
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
2635a17 to
c009d77
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
d80e1ab to
71701ee
Compare
71701ee to
53ef050
Compare
53ef050 to
eb998c9
Compare
eb998c9 to
b43c5c7
Compare
b43c5c7 to
d4c2fab
Compare
ee6baa5 to
5551b9e
Compare
5551b9e to
c5662cd
Compare
This PR contains the following updates:
^1.0.25→^2.0.0Release Notes
vercel/ai (@ai-sdk/mcp)
v2.0.31Patch Changes
7fbfc6d]v2.0.30Compare Source
Patch Changes
401a4ba]v2.0.29Compare Source
Patch Changes
ad6a650]81cd026]v2.0.28Compare Source
Patch Changes
1937bef]v2.0.27Compare Source
Patch Changes
3469d0c]v2.0.26Compare Source
Patch Changes
2b60826]v2.0.25Compare Source
Patch Changes
1bec07d]v2.0.24Compare Source
Patch Changes
160ccdb]v2.0.23Compare Source
Patch Changes
79e133c]v2.0.22Compare Source
Patch Changes
5fc7da5]93b2acd]v2.0.21Compare Source
Patch Changes
fa95504]v2.0.20Compare Source
Patch Changes
97f0565: Honor MCP request deadlines and support bounding or aborting client initialization.d8210b6]b192878]v2.0.19Compare Source
Patch Changes
1659cd5]6a5bdff]v2.0.18Compare Source
Patch Changes
0c464d9]c49380c]v2.0.17Compare Source
Patch Changes
1e2f324]v2.0.16Compare Source
Patch Changes
02ffdcb]76cb673]v2.0.15Compare Source
Patch Changes
d84ea43: fix(mcp): accept OAuth metadata without code challenge methodscd06458]v2.0.14Compare Source
Patch Changes
48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:_meta.uiand drop malformed or non-string fields.sandbox.allowedPermissionsallowlist.postMessagetarget origin and validate inbound message origins.resources/readtoui://resources and allow onlyhttps/http/mailtoinui/open-link.fingerprintMCPAppResource/detectMCPAppResourceDriftfor pinning and comparing app resources.v2.0.13Patch Changes
31c7be8]v2.0.12Patch Changes
4be62c1]7805e4a]cd12954]v2.0.10Compare Source
Patch Changes
0f93c57]v2.0.9Compare Source
Patch Changes
ac306ed]v2.0.8Compare Source
Patch Changes
3e6e955: Reject in-flight MCP requests when their abort signal fires and remove the pending response handler.eebd14b: Prevent streamable HTTP MCP background SSE disconnects from surfacing as unhandled promise rejections.v2.0.7Compare Source
Patch Changes
5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAIgpt-realtime-whisperand xAI WebSocket STT.5c5c0f5]v2.0.6Compare Source
Patch Changes
3c30eb4: feat(mcp): expose a json-rpc message validatorc6f5e62]v2.0.5Compare Source
Patch Changes
8c616f0: feat(mcp): add maxRetries option for failed mcp tool calls8c616f0]v2.0.4Compare Source
Patch Changes
0274f34]v2.0.3Compare Source
Patch Changes
68a739a: feat(mcp): allow MCP client to use server completions6a436e3]v2.0.2Compare Source
Patch Changes
ba6d510: chore: fix deprecated use of zod.passthrough()v2.0.1Compare Source
Patch Changes
241a8c5: Add Streamable HTTP session hooks, cached initialize metadata, and detach-on-close support for reattaching to MCP sessions.v2.0.0Compare Source
Major Changes
23fa161: fix(mcp): setting redirect: error for MCP transportef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers usingrequire()must switch to ESMimportsyntax.8359612: Start v7 pre-releasePatch Changes
b79094c: Addresource_linkcontent type toCallToolResultSchemaandPromptMessageSchemaper MCP spec. Fixes hard rejection when MCP servers returnresource_linkcontent parts with zod ≥ 4.4.x.78e0023: fix(mcp): await addClientAuthentication in token exchange and refreshb567a6c: dependency updatese33ad0b: fix(mcp): add optional hook to validate authorization serverse3ea484: fix(mcp): bypass outputSchema validation when tool returns isError93afb28: feat(mcp): expose server instructions to be accessible through clienta00d1d3: feat(mcp): allow custom fetch for HTTP and SSE transportsa98bf66: feat(mcp): surface 'serverInfo' exposed from the MCP server2a150f8: fix(mcp): lock first sse endpoint received via event2655da8: fix(mcp): use negotiated protocol version in transport request headers9f0e36c: trigger release for all packages after provenance setupf7bc0b4: feat(mcp): exposestatusCode,url, andresponseBodyonMCPClientErrorfor HTTP transport failuresMCPClientErrornow carries structured HTTP context when it originates from thestreamable HTTP transport. This lets downstream consumers (e.g. agent frameworks
that need to decide whether to fall back from streamable HTTP to legacy SSE
transport per the MCP spec) branch on the actual response status without parsing
the error message string.
Fields are optional — they remain
undefinedfor stdio transport errors and fornon-response failures (network errors, aborts).
dcefad3: fix(mcp): respond to ping requests with an empty result per JSON-RPC spec (closes #6282)b44b051: fix(mcp): prevent prototype-named tools from bypassing theschemasallowlistWhen using
client.tools({ schemas })to expose only an explicitly allowedsubset of an MCP server's tools, the allowlist check used the
inoperator,which also matches inherited
Object.prototypeproperties. A server-advertisedtool named
constructor,toString,__proto__, etc. would pass the checkeven though the developer never defined it in
schemas, and was then exposed tothe model and executable. The check now uses
Object.hasOwn, so onlyexplicitly defined tools are returned.
f634bac: feat(mcp): add new McpProviderMetadata typeb9b3899: changeset for #133841e89d62: fix(mcp): strip trailing slash from OAuth resource parameter3e0b82f: fix(mcp): support official sdk protocol version negotiation1451759: feat(mcp): deprecate name and use clientName for MCPClient7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.08d2129: feat(mcp): propagate the server name through dynamic tool parts58c9eb1: feat(mcp): addredirectoption toMCPTransportConfigfor controlling HTTP redirect behavior0c4c275: trigger initial canary release611f621: feat(mcp): feat(mcp): add support for MCP Apps9ecd8ae: fix(mcp): add MCP protocol version 2025-11-25 to supported versions6c17a9f: fix(mcp): deduplicate auth refresh on http transport69254e0: feat(ai): add toolMetadata for tool specific metdata258c093: chore: ensure consistent import handling and avoid import duplicates or cyclesf0c6770: fix(mcp): prevent mcp oauth credential exfiltration during rediscovery5463d0d: feat(provider): align tool result output content file part types with top-level message file part typesb8396f0: trigger initial beta releaseb29e087: fix (mcp): handle SSE messages without explicit event fields90e2d8a: chore: fix unused vars not being flagged by our lint tooling024a6b4: fix(mcp): validate oauth metadata issuer during discovery9b0bc8a: fix(mcp): prevent prototype pollution by using secureJsonParseff5eba1: feat: rollimage-*tool output types into their equivalentfile-*typesv1.0.71Compare Source
Patch Changes
b0e77c0: Select MCP OAuth authorization scopes fromWWW-Authenticatechallenges or Protected Resource Metadata.31205a4]v1.0.70Compare Source
Patch Changes
b2a4d5a]v1.0.69Compare Source
Patch Changes
2171d15]v1.0.68Compare Source
Patch Changes
dab0a08]v1.0.67Compare Source
Patch Changes
ee2bf30]v1.0.66Compare Source
Patch Changes
e8d2654: Honor MCP request deadlines and support bounding or aborting client initialization.v1.0.65Compare Source
Patch Changes
9ecdefe]v1.0.64Compare Source
Patch Changes
a3bc948: fix(mcp): accept OAuth metadata without code challenge methodsv1.0.63Compare Source
Patch Changes
19093fd]v1.0.62Compare Source
Patch Changes
06fb54c]v1.0.61Compare Source
Patch Changes
e1af05f]v1.0.60Compare Source
Patch Changes
937d731: Reject in-flight MCP requests when their abort signal fires and remove the pending response handler.2b6c67f: Prevent streamable HTTP MCP background SSE disconnects from surfacing as unhandled promise rejections.d559de9]v1.0.59Compare Source
Patch Changes
0952964]v1.0.58Compare Source
Patch Changes
f12f0d3: feat(mcp): expose a json-rpc message validatorv1.0.57Compare Source
Patch Changes
ea1e95b: feat(mcp): add maxRetries option for failed mcp tool callsea1e95b]v1.0.56Compare Source
Patch Changes
fa850e6]v1.0.55Compare Source
Patch Changes
3d0bd52: feat(mcp): allow MCP client to use server completionsb30e43a]v1.0.54Compare Source
Patch Changes
f19334d]v1.0.53Compare Source
Patch Changes
1b40ac7: Publish all packages under the@ai-v6dist tag.1b40ac7]v1.0.52Compare Source
Patch Changes
779f5cd]v1.0.51Patch Changes
aa39fc8: fix (mcp): handle SSE messages without explicit event fieldsv1.0.49Patch Changes
3e8d9ba: fix(mcp): lock first sse endpoint received via event4fa7354: fix(mcp): prevent prototype-named tools from bypassing theschemasallowlistWhen using
client.tools({ schemas })to expose only an explicitly allowedsubset of an MCP server's tools, the allowlist check used the
inoperator,which also matches inherited
Object.prototypeproperties. A server-advertisedtool named
constructor,toString,__proto__, etc. would pass the checkeven though the developer never defined it in
schemas, and was then exposed tothe model and executable. The check now uses
Object.hasOwn, so onlyexplicitly defined tools are returned.
Updated dependencies [
bfa5864]Updated dependencies [
f42aa79]v1.0.47Compare Source
Patch Changes
bf1d6bd: fix(mcp): prevent mcp oauth credential exfiltration during rediscoveryv1.0.46Compare Source
Patch Changes
1f817db: fix(mcp): await addClientAuthentication in token exchange and refreshv1.0.45Compare Source
Patch Changes
ec5fceb: fix(mcp): respond to ping requests with an empty result per JSON-RPC spec (closes #6282)v1.0.44Compare Source
Patch Changes
77775a4: feat(mcp): exposestatusCode,url, andresponseBodyonMCPClientErrorfor HTTP transport failuresMCPClientErrornow carries structured HTTP context when it originates from thestreamable HTTP transport. This lets downstream consumers (e.g. agent frameworks
that need to decide whether to fall back from streamable HTTP to legacy SSE
transport per the MCP spec) branch on the actual response status without parsing
the error message string.
Fields are optional — they remain
undefinedfor stdio transport errors and fornon-response failures (network errors, aborts).
v1.0.43Compare Source
Patch Changes
e2b923f: fix(mcp): deduplicate auth refresh on http transportv1.0.42Compare Source
Patch Changes
725f2ed: feat(mcp): expose server instructions to be accessible through client7281592: fix(mcp): use negotiated protocol version in transport request headersv1.0.41Compare Source
Patch Changes
f591416: feat(ai): add toolMetadata for tool specific metdataf591416]v1.0.40Compare Source
Patch Changes
221a984: Addresource_linkcontent type toCallToolResultSchemaandPromptMessageSchemaper MCP spec. Fixes hard rejection when MCP servers returnresource_linkcontent parts with zod ≥ 4.4.x.0084974: feat(mcp): deprecate name and use clientName for MCPClientv1.0.39Compare Source
Patch Changes
7beadf0: feat(mcp): propagate the server name through dynamic tool parts7beadf0]v1.0.38Compare Source
Patch Changes
a727da4: chore: ensure consistent import handling and avoid import duplicates or cycles5fee301: fix(mcp): prevent prototype pollution by using secureJsonParsea727da4]v1.0.37Compare Source
Patch Changes
a7f3c72: trigger release for all packages after provenance setupa7f3c72]v1.0.36Compare Source
Patch Changes
9a8d276: feat(mcp): surface 'serverInfo' exposed from the MCP serverv1.0.35Compare Source
Patch Changes
941ebf2: fix(mcp): bypass outputSchema validation when tool returns isErrorv1.0.34Compare Source
Patch Changes
1141b93: feat(mcp): allow custom fetch for HTTP and SSE transportsv1.0.33Compare Source
Patch Changes
6247886]v1.0.32Compare Source
Patch Changes
47c6af0: fix(mcp): strip trailing slash from OAuth resource parameterv1.0.31Compare Source
Patch Changes
0469aed]v1.0.30Compare Source
Patch Changes
055cd68: fix: publish v6 to latest npm dist tag055cd68]v1.0.29Compare Source
Patch Changes
cc8b506: feat(mcp): addredirectoption toMCPTransportConfigfor controlling HTTP redirect behaviorv1.0.28Compare Source
Patch Changes
0c86a13: fix(mcp): validate state param in oauth flowv1.0.27Compare Source
Patch Changes
1920b22: fix(mcp): add MCP protocol version 2025-11-25 to supported versionsv1.0.26Compare Source
Patch Changes
64ac0fd]Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.