Skip to content

Bump the npm_and_yarn group across 10 directories with 12 updates#75

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/examples/agents/claude-agent-descope-gmail/npm_and_yarn-f5bb5181a3
Open

Bump the npm_and_yarn group across 10 directories with 12 updates#75
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/examples/agents/claude-agent-descope-gmail/npm_and_yarn-f5bb5181a3

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 19, 2026

Bumps the npm_and_yarn group with 3 updates in the /examples/agents/claude-agent-descope-gmail directory: @modelcontextprotocol/sdk, hono and qs.
Bumps the npm_and_yarn group with 5 updates in the /examples/brave-search-mcp-server directory:

Package From To
@modelcontextprotocol/sdk 1.9.0 1.26.0
hono 4.11.4 4.11.7
agents 0.0.43 0.3.10
wrangler 4.10.0 4.59.1
markdown-it 14.1.0 14.1.1

Bumps the npm_and_yarn group with 2 updates in the /examples/express-mcp-server directory: @modelcontextprotocol/sdk and lodash.
Bumps the npm_and_yarn group with 2 updates in the /examples/express-netlify-mcp-server directory: @modelcontextprotocol/sdk and lodash.
Bumps the npm_and_yarn group with 5 updates in the /examples/integrations/skyflow-descope-mcp-server directory:

Package From To
@modelcontextprotocol/sdk 1.20.0 1.26.0
qs 6.14.0 6.15.0
tar 7.5.1 7.5.9
ai 4.3.19 5.0.52
next 15.4.10 15.5.10

Bumps the npm_and_yarn group with 2 updates in the /examples/mcp-server-cloudrun directory: @modelcontextprotocol/sdk and lodash.
Bumps the npm_and_yarn group with 4 updates in the /examples/nextjs-vercel-mcp-server directory: @modelcontextprotocol/sdk, tar, ai and next.
Bumps the npm_and_yarn group with 2 updates in the /examples/remote-mcp-server-express-fly directory: @modelcontextprotocol/sdk and lodash.
Bumps the npm_and_yarn group with 5 updates in the /examples/remote-mcp-server-hono-cloudflare directory:

Package From To
@modelcontextprotocol/sdk 1.8.0 1.26.0
agents 0.0.43 0.3.10
wrangler 4.6.0 4.59.1
lodash 4.17.21 4.17.23
markdown-it 14.1.0 14.1.1

Bumps the npm_and_yarn group with 5 updates in the /examples/weather-mcp-server directory:

Package From To
@modelcontextprotocol/sdk 1.9.0 1.26.0
hono 4.7.6 4.11.7
agents 0.0.43 0.3.10
wrangler 4.10.0 4.59.1
markdown-it 14.1.0 14.1.1

Updates @modelcontextprotocol/sdk from 1.25.3 to 1.26.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

Commits
  • fe9c07b chore: bump version to 1.26.0 (#1479)
  • 4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
  • a05be17 Merge commit from fork
  • 50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
  • aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
  • 6aba065 chore: bump v1.25.3 for backport fixes (#1412)
  • See full diff in compare view

Updates hono from 4.11.5 to 4.12.0

Release notes

Sourced from hono's releases.

v4.12.0

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')
// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'
// With path parameters
const postPath = client.api.posts[':id'].$path({
param: { id: '123' },
})
// => '/api/posts/123'
// With query parameters
const searchPath = client.api.posts.$path({
query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @​ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))
type AppWithErrors = ApplyGlobalResponse<
typeof app,
{
401: { json: { error: string; message: string } }
500: { json: { error: string; message: string } }
}
</tr></table>

... (truncated)

Commits
  • d2ed2e9 4.12.0
  • 01e78ad Merge pull request #4735 from honojs/next
  • a340a25 perf(context): use createResponseInstance for new Response (#4733)
  • bd26c31 perf(trie-router): improve performance (1.5x ~ 2.0x) (#4724)
  • b85c1e0 feat(types): Add exports field to ExecutionContext (#4719)
  • 02346c6 feat(language): add progressive locale code truncation to normalizeLanguage (...
  • 7438ab9 perf(context): add fast path to c.json() matching c.text() optimization (#4707)
  • 034223f feat(trailing-slash): add alwaysRedirect option to support wildcard routes ...
  • 16321af feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify ...
  • bf37828 feat(basic-auth): add context key and callback options (#4645)
  • Additional commits viewable in compare view

Updates qs from 6.14.1 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions
Commits
  • d9b4c66 v6.15.0
  • cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
  • 88e1563 [Fix] duplicates option should not apply to bracket notation keys
  • 9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
  • 85cc8ca v6.12.5
  • ffc12aa v6.11.4
  • 0506b11 [actions] update reusable workflows
  • 6a37faf [actions] update reusable workflows
  • 8e8df5a [Fix] fix regressions from robustness refactor
  • d60bab3 v6.10.7
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.9.0 to 1.26.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

Commits
  • fe9c07b chore: bump version to 1.26.0 (#1479)
  • 4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
  • a05be17 Merge commit from fork
  • 50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
  • aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
  • 6aba065 chore: bump v1.25.3 for backport fixes (#1412)
  • See full diff in compare view

Updates body-parser from 2.2.0 to 2.2.2

Release notes

Sourced from body-parser's releases.

v2.2.2

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.1...v2.2.2

v2.2.1

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3
Commits

Updates hono from 4.11.4 to 4.11.7

Release notes

Sourced from hono's releases.

v4.12.0

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')
// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'
// With path parameters
const postPath = client.api.posts[':id'].$path({
param: { id: '123' },
})
// => '/api/posts/123'
// With query parameters
const searchPath = client.api.posts.$path({
query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @​ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))
type AppWithErrors = ApplyGlobalResponse<
typeof app,
{
401: { json: { error: string; message: string } }
500: { json: { error: string; message: string } }
}
</tr></table>

... (truncated)

Commits
  • d2ed2e9 4.12.0
  • 01e78ad Merge pull request #4735 from honojs/next
  • a340a25 perf(context): use createResponseInstance for new Response (#4733)
  • bd26c31 perf(trie-router): improve performance (1.5x ~ 2.0x) (#4724)
  • b85c1e0 feat(types): Add exports field to ExecutionContext (#4719)
  • 02346c6 feat(language): add progressive locale code truncation to normalizeLanguage (...
  • 7438ab9 perf(context): add fast path to c.json() matching c.text() optimization (#4707)
  • 034223f feat(trailing-slash): add alwaysRedirect option to support wildcard routes ...
  • 16321af feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify ...
  • bf37828 feat(basic-auth): add context key and callback options (#4645)
  • Additional commits viewable in compare view

Updates qs from 6.14.0 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions
Commits
  • d9b4c66 v6.15.0
  • cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
  • 88e1563 [Fix] duplicates option should not apply to bracket notation keys
  • 9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
  • 85cc8ca v6.12.5
  • ffc12aa v6.11.4
  • 0506b11 [actions] update reusable workflows
  • 6a37faf [actions] update reusable workflows
  • 8e8df5a [Fix] fix regressions from robustness refactor
  • d60bab3 v6.10.7
  • Additional commits viewable in compare view

Updates agents from 0.0.43 to 0.3.10

Release notes

Sourced from agents's releases.

agents@0.3.10

Patch Changes

  • #839 68916bf Thanks @​whoiskatrin! - Invalidate query cache on disconnect to fix stale auth tokens

  • #841 3f490d0 Thanks @​mattzcarey! - Escape authError to prevent XSS attacks and store it in the connection state to avoid needing script tags to display error.

  • Updated dependencies [83f137f]:

    • @​cloudflare/ai-chat@​0.0.6

agents@0.3.9

Patch Changes

  • #837 b11b9dd Thanks @​threepointone! - Fix AgentWorkflow run() method not being called in production

    The run() method wrapper was being set as an instance property in the constructor, but Cloudflare's RPC system invokes methods from the prototype chain. This caused the initialization wrapper to be bypassed in production, resulting in _initAgent never being called.

    Changed to wrap the subclass prototype's run method directly with proper safeguards:

    • Uses Object.hasOwn() to only wrap prototypes that define their own run method (prevents double-wrapping inherited methods)
    • Uses a WeakSet to track wrapped prototypes (prevents re-wrapping on subsequent instantiations)
    • Uses an instance-level __agentInitCalled flag to prevent double initialization if super.run() is called from a subclass

agents@0.3.8

Patch Changes

  • #833 6c80022 Thanks @​tarushnagpal! - On invalid OAuth state, clear auth_url in storage and set the MCP connection state to FAILED ready for reconnection.

  • #834 2b4aecd Thanks @​threepointone! - Fix AgentClient.close() to immediately reject pending RPC calls instead of waiting for WebSocket close handshake timeout.

    Previously, calling client.close() would not reject pending RPC calls until the WebSocket close handshake completed (which could take 15+ seconds in some environments). Now pending calls are rejected immediately when close() is called, providing faster feedback on intentional disconnects.

agents@0.3.7 Release Notes

This release introduces Cloudflare Workflows integration for durable multi-step processing, secure email reply routing with HMAC-SHA256 signatures, 15+ new documentation files, and significant improvements to state management, the callable RPC system, and scheduling.

agents@0.3.6

Patch Changes

agents@0.3.5

Patch Changes

... (truncated)

Changelog

Sourced from agents's changelog.

0.3.10

Patch Changes

  • #839 68916bf Thanks @​whoiskatrin! - Invalidate query cache on disconnect to fix stale auth tokens

  • #841 3f490d0 Thanks @​mattzcarey! - Escape authError to prevent XSS attacks and store it in the connection state to avoid needing script tags to display error.

  • Updated dependencies [83f137f]:

    • @​cloudflare/ai-chat@​0.0.6

0.3.9

Patch Changes

  • #837 b11b9dd Thanks @​threepointone! - Fix AgentWorkflow run() method not being called in production

    The run() method wrapper was being set as an instance property in the constructor, but Cloudflare's RPC system invokes methods from the prototype chain. This caused the initialization wrapper to be bypassed in production, resulting in _initAgent never being called.

    Changed to wrap the subclass prototype's run method directly with proper safeguards:

    • Uses Object.hasOwn() to only wrap prototypes that define their own run method (prevents double-wrapping inherited methods)
    • Uses a WeakSet to track wrapped prototypes (prevents re-wrapping on subsequent instantiations)
    • Uses an instance-level __agentInitCalled flag to prevent double initialization if super.run() is called from a subclass

0.3.8

Patch Changes

  • #833 6c80022 Thanks @​tarushnagpal! - On invalid OAuth state, clear auth_url in storage and set the MCP connection state to FAILED ready for reconnection.

  • #834 2b4aecd Thanks @​threepointone! - Fix AgentClient.close() to immediately reject pending RPC calls instead of waiting for WebSocket close handshake timeout.

    Previously, calling client.close() would not reject pending RPC calls until the WebSocket close handshake completed (which could take 15+ seconds in some environments). Now pending calls are rejected immediately when close() is called, providing faster feedback on intentional disconnects.

0.3.7

agents@0.3.7 Release Notes

This release introduces Cloudflare Workflows integration for durable multi-step processing, secure email reply routing with HMAC-SHA256 signatures, 15+ new documentation files, and significant improvements to state management, the callable RPC system, and scheduling.

Highlights

  • Workflows Integration - Seamless integration between Cloudflare Agents and Cloudflare Workflows for durable, multi-step background processing
  • Secure Email Routing - HMAC-SHA256 signed email headers prevent unauthorized routing of emails to agent instances
  • Comprehensive Documentation - 15+ new docs covering getting started, state, routing, HTTP/WebSocket lifecycle, callable methods, MCP, and scheduling
  • Synchronous setState() - State updates are now synchronous with a new validateStateChange() validation hook
  • scheduleEvery() Method - Fixed-interval recurring tasks with overlap prevention
  • Callable System Improvements - Client-side RPC timeouts, streaming error signaling, introspection API
  • 100+ New Tests - Comprehensive test coverage across state, routing, callable, and email utilities

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for agents since your current version.


Updates wrangler from 4.10.0 to 4.59.1

Release notes

Sourced from wrangler's releases.

wrangler@4.59.1

Patch Changes

  • #11889 99b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy

    Pass user provided values from --commit-hash safely to underlying git command.

wrangler@4.59.0

Minor Changes

  • #11852 ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command

    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.

    When types are up-to-date, the command exits with code 0:

    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.

    When types are out-of-date, the command exits with code 1:

    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.

    You can also use it with a custom output path:

    $ wrangler types ./custom-types.d.ts --check

  • #11529 43d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments

    Wrangler can now read asset count limits from JWT claims during Pages deployments, allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account basis. The default limit remains at 20,000 assets.

  • #11755 0f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers. If left unset, we will default to tiers: [1, 2]. Note that constraints is an experimental feature.

Patch Changes

  • #11820 b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events

    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.

... (truncated)

Commits
  • 37a8607 Version Packages (#11890)
  • 99b1f32 fix: execute git commands in pages deploy safely (#11889)
  • e98c95a Version Packages (#11836)
  • ad65efa Add --check flag to wrangler types (#11852)
  • beb96af feat(unenv-preset): add support for native node:sqlite module (#11841)
  • b0e54b2 [wrangler] Add AI agent detection to analytics events (#11820)
  • 2203af4 Add Node.js 24 and 25 compatibility to the test suites for Miniflare, Wrangle...
  • b6148ed chore(deps): bump the workerd-and-workers-types group with 2 updates (#11872)
  • 0eb973d Do not warn user when using a redirected config that came from a config with ...
  • 0f8d69d containers: users can set multiple tiers for constraints (#11755)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for wrangler since your current version.


Updates lodash from 4.17.21 to 4.17.23

Commits
  • dec55b7 Bump main to v4.17.23 (#6088)
  • 19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
  • b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
  • edadd45 Prevent prototype pollution on baseUnset function
  • 4879a7a doc: fix autoLink function, conversion of source links (#6056)
  • 9648f69 chore: remove yarn.lock file (Description has been truncated

@dependabot
Bump the npm_and_yarn group across 10 directories with 12 updates
698608e 
Bumps the npm_and_yarn group with 3 updates in the /examples/agents/claude-agent-descope-gmail directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [hono](https://github.com/honojs/hono) and [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 5 updates in the /examples/brave-search-mcp-server directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.9.0` | `1.26.0` |
| [hono](https://github.com/honojs/hono) | `4.11.4` | `4.11.7` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.0.43` | `0.3.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.10.0` | `4.59.1` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.1.1` |

Bumps the npm_and_yarn group with 2 updates in the /examples/express-mcp-server directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [lodash](https://github.com/lodash/lodash).
Bumps the npm_and_yarn group with 2 updates in the /examples/express-netlify-mcp-server directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [lodash](https://github.com/lodash/lodash).
Bumps the npm_and_yarn group with 5 updates in the /examples/integrations/skyflow-descope-mcp-server directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.20.0` | `1.26.0` |
| [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.15.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.1` | `7.5.9` |
| [ai](https://github.com/vercel/ai) | `4.3.19` | `5.0.52` |
| [next](https://github.com/vercel/next.js) | `15.4.10` | `15.5.10` |

Bumps the npm_and_yarn group with 2 updates in the /examples/mcp-server-cloudrun directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [lodash](https://github.com/lodash/lodash).
Bumps the npm_and_yarn group with 4 updates in the /examples/nextjs-vercel-mcp-server directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [tar](https://github.com/isaacs/node-tar), [ai](https://github.com/vercel/ai) and [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 2 updates in the /examples/remote-mcp-server-express-fly directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [lodash](https://github.com/lodash/lodash).
Bumps the npm_and_yarn group with 5 updates in the /examples/remote-mcp-server-hono-cloudflare directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.8.0` | `1.26.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.0.43` | `0.3.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.6.0` | `4.59.1` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.1.1` |

Bumps the npm_and_yarn group with 5 updates in the /examples/weather-mcp-server directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.9.0` | `1.26.0` |
| [hono](https://github.com/honojs/hono) | `4.7.6` | `4.11.7` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.0.43` | `0.3.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.10.0` | `4.59.1` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.1.1` |



Updates `@modelcontextprotocol/sdk` from 1.25.3 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `hono` from 4.11.5 to 4.12.0
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.5...v4.12.0)

Updates `qs` from 6.14.1 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.15.0)

Updates `@modelcontextprotocol/sdk` from 1.9.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `hono` from 4.11.4 to 4.11.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.5...v4.12.0)

Updates `qs` from 6.14.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.15.0)

Updates `agents` from 0.0.43 to 0.3.10
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.3.10/packages/agents)

Updates `wrangler` from 4.10.0 to 4.59.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `markdown-it` from 14.1.0 to 14.1.1
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.0...14.1.1)

Updates `@modelcontextprotocol/sdk` from 1.10.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@modelcontextprotocol/sdk` from 1.13.1 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Removes `lodash`

Updates `fastify` from 4.28.1 to 5.7.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.28.1...v5.7.3)

Updates `tar` from 6.2.1 to 7.5.7
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.1...v7.5.9)

Updates `@modelcontextprotocol/sdk` from 1.20.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `qs` from 6.14.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.15.0)

Updates `tar` from 7.5.1 to 7.5.9
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.1...v7.5.9)

Updates `ai` from 4.3.19 to 5.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/compare/ai@4.3.19...ai@5.0.52)

Updates `next` from 15.4.10 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.10...v15.5.10)

Updates `@modelcontextprotocol/sdk` from 1.13.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@modelcontextprotocol/sdk` from 1.20.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `qs` from 6.14.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.15.0)

Updates `tar` from 7.5.1 to 7.5.9
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.1...v7.5.9)

Updates `ai` from 4.3.19 to 5.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/compare/ai@4.3.19...ai@5.0.52)

Updates `next` from 15.4.10 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.10...v15.5.10)

Updates `@modelcontextprotocol/sdk` from 1.24.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@modelcontextprotocol/sdk` from 1.8.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `hono` from 4.7.5 to 4.12.0
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.5...v4.12.0)

Updates `qs` from 6.13.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.15.0)

Updates `agents` from 0.0.43 to 0.3.10
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.3.10/packages/agents)

Updates `wrangler` from 4.6.0 to 4.59.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `markdown-it` from 14.1.0 to 14.1.1
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.0...14.1.1)

Updates `@modelcontextprotocol/sdk` from 1.9.0 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0)

Updates `body-parser` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.2.2)

Updates `hono` from 4.7.6 to 4.11.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.5...v4.12.0)

Updates `qs` from 6.14.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.15.0)

Updates `agents` from 0.0.43 to 0.3.10
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.3.10/packages/agents)

Updates `wrangler` from 4.10.0 to 4.59.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `markdown-it` from 14.1.0 to 14.1.1
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.0...14.1.1)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.11.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: agents
  dependency-version: 0.3.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: wrangler
  dependency-version: 4.59.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.7.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ai
  dependency-version: 5.0.52
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ai
  dependency-version: 5.0.52
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: agents
  dependency-version: 0.3.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: wrangler
  dependency-version: 4.59.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.11.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: agents
  dependency-version: 0.3.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: wrangler
  dependency-version: 4.59.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026
@netlify
Copy link

netlify bot commented Feb 19, 2026 •
edited
Loading

✅ Deploy Preview for express-mcp-server ready!

Name Link
🔨 Latest commit 698608e
🔍 Latest deploy log https://app.netlify.com/projects/express-mcp-server/deploys/6997569b6f38e80008182463
😎 Deploy Preview https://deploy-preview-75--express-mcp-server.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@vercel
Copy link
Contributor

vercel bot commented Feb 19, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
ai Ready Ready Preview, Comment Feb 19, 2026 6:30pm
nextjs-descope-mcp-server Ready Ready Preview, Comment Feb 19, 2026 6:30pm

Request Review

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 19, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
🔵 In progress
View logs		 remote-mcp-server-bearer-auth 698608e Feb 19 2026, 06:29 PM

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 19, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
🔵 In progress
View logs		 weather-mcp-server 698608e Feb 19 2026, 06:29 PM

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 19, 2026 •
edited
Loading

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 brave-search-mcp-server 698608e Feb 19 2026, 06:30 PM

@netlify
Copy link

netlify bot commented Feb 19, 2026 •
edited
Loading

✅ Deploy Preview for mcp-example-oauth ready!

Name Link
🔨 Latest commit 698608e
🔍 Latest deploy log https://app.netlify.com/projects/mcp-example-oauth/deploys/6997569bff91860008cd5ef3
😎 Deploy Preview https://deploy-preview-75--mcp-example-oauth.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gaokevin1 gaokevin1 Awaiting requested review from gaokevin1 gaokevin1 is a code owner

@anvibanga anvibanga Awaiting requested review from anvibanga anvibanga is a code owner

@mrunankpawar mrunankpawar Awaiting requested review from mrunankpawar mrunankpawar is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants