From cbfb00b75fa963e436e68681ba470e3785400a7a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 07:23:17 +0000 Subject: [PATCH 1/2] chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0 Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.29.0 to 1.30.0. - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 10 +++++----- package.json | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 969db0d6..ce002bc8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "1.2.0", "license": "MIT", "dependencies": { - "@modelcontextprotocol/sdk": "^1.29.0", + "@modelcontextprotocol/sdk": "^1.30.0", "ajv": "^8.20.0", "ajv-formats": "^3.0.1", "commander": "^15.0.0" @@ -488,12 +488,12 @@ "license": "MIT" }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.29.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz", - "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==", + "version": "1.30.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", + "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", diff --git a/package.json b/package.json index 020c8b1f..ceca636b 100644 --- a/package.json +++ b/package.json @@ -54,7 +54,7 @@ "vitest": "^2.1.0" }, "dependencies": { - "@modelcontextprotocol/sdk": "^1.29.0", + "@modelcontextprotocol/sdk": "^1.30.0", "ajv": "^8.20.0", "ajv-formats": "^3.0.1", "commander": "^15.0.0" From 09aaee9231e1867e6c12afa0d31c50f279b423af Mon Sep 17 00:00:00 2001 From: operator Date: Mon, 7 Sep 2026 10:20:08 +0900 Subject: [PATCH 2/2] the SDK is bundled, so its bump moves the artifact as well as the digest Dependabot bumped @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 and CI's `check` failed with "source checksum does not match this checkout", the same contract clause r-cdebmanifest describes: `package-lock.json` is a source input. Unlike a dev-only bump this one is a runtime dependency, so the canonical build was the only way to learn what `dist/` becomes. It moved: `dist/commitlore.mjs` grew 1378376 -> 1378660 bytes and the artifact digest is 71622373f47857591fa72c34a07b2b940f9553ceb34c8e70d4a040854e8ca080 rather than e8183a8f... . Both the rebuilt bundle and the regenerated manifest are committed here, because a manifest recording a dist nobody committed would verify on the machine that built it and nowhere else. Record-Id: r-sdkbundlemoves Follows: r-cdebmanifest Provenance: authored Certainty: firm Blast: module Undo: easy Ruled-out: committing the manifest without the rebuilt dist/commitlore.mjs | the manifest records the artifact's checksum, so the pair only verifies together; splitting them would leave main verifying against bytes it does not contain Limit: says nothing about whether 1.30.0 changes MCP behaviour at runtime; the suite covers this repository's use of the SDK and not the SDK itself Verified: the pinned linux/amd64 build produced the committed dist; artifact:verify exits 0 on the committed pair; typecheck, check-engines and 3157 tests pass on this branch Unverified: npm audit --omit=dev still reports fast-uri and qs advisories here, but it reports them on main too and 1.30.0 changes neither; that is fixed on a separate branch --- dist/commitlore.mjs | 34 ++++++++++++++++++------------- installer/canonical-artifact.json | 6 +++--- 2 files changed, 23 insertions(+), 17 deletions(-) diff --git a/dist/commitlore.mjs b/dist/commitlore.mjs index a3989cff..7a797e22 100755 --- a/dist/commitlore.mjs +++ b/dist/commitlore.mjs @@ -34202,16 +34202,7 @@ var Server = class extends Protocol { if (!methodSchema) { throw new Error("Schema is missing a method literal"); } - let methodValue; - if (isZ4Schema(methodSchema)) { - const v4Schema = methodSchema; - const v4Def = v4Schema._zod?.def; - methodValue = v4Def?.value ?? v4Schema.value; - } else { - const v3Schema = methodSchema; - const legacyDef = v3Schema._def; - methodValue = legacyDef?.value ?? v3Schema.value; - } + const methodValue = getLiteralValue(methodSchema); if (typeof methodValue !== "string") { throw new Error("Schema method literal must be a string"); } @@ -34520,8 +34511,17 @@ var Server = class extends Protocol { import process4 from "node:process"; // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js +var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024; var ReadBuffer = class { + constructor(options) { + this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE; + } append(chunk) { + const newSize = (this._buffer?.length ?? 0) + chunk.length; + if (newSize > this._maxBufferSize) { + this.clear(); + throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`); + } this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk; } readMessage() { @@ -34549,18 +34549,24 @@ function serializeMessage(message) { // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js var StdioServerTransport = class { - constructor(_stdin = process4.stdin, _stdout = process4.stdout) { + constructor(_stdin = process4.stdin, _stdout = process4.stdout, options) { this._stdin = _stdin; this._stdout = _stdout; - this._readBuffer = new ReadBuffer(); this._started = false; this._ondata = (chunk) => { - this._readBuffer.append(chunk); - this.processReadBuffer(); + try { + this._readBuffer.append(chunk); + this.processReadBuffer(); + } catch (error2) { + this.onerror?.(error2); + this.close().catch(() => { + }); + } }; this._onerror = (error2) => { this.onerror?.(error2); }; + this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize }); } /** * Starts listening for messages on stdin. diff --git a/installer/canonical-artifact.json b/installer/canonical-artifact.json index 900cad39..00dc5519 100644 --- a/installer/canonical-artifact.json +++ b/installer/canonical-artifact.json @@ -15,10 +15,10 @@ "tsconfig.json", "src" ], - "sha256": "fcedf58190a9ff4f3485c8615527dad7b8c91c8a0f8de9cc73f07e7a81bc14e1" + "sha256": "77e7daed1bccab724c9dcedb7dbd20580edf82b53ad7b14a2f6b75cc799480bd" }, "artifact": { - "sha256": "e8183a8fd3171c20b92c6234fc7ef0826cf4853d71471d421485b2bd71fc88fe", + "sha256": "71622373f47857591fa72c34a07b2b940f9553ceb34c8e70d4a040854e8ca080", "files": [ { "path": "dist/cli.d.ts", @@ -622,7 +622,7 @@ }, { "path": "dist/commitlore.mjs", - "sha256": "747b697be3a13db12a12844d0739f419cac4a569dc176aac8ada298cba4fae32" + "sha256": "214832fc81e83a058fadbb5fc49884d88316afc8180d38191f04da055e208cbf" }, { "path": "dist/core/agent-configs.d.ts",