fix: remediate remaining dependency vulnerabilities

ts/README.md

@@ -40,6 +40,19 @@ In this directory:
 - Run `pnpm i`
 - Run `pnpm run build`
 
+### Dependency security checks
+
+The [workspace overrides](./pnpm-workspace.yaml) require MCP SDK 1.32.0 or
+later and keep Milkdown's Vue runtime and server renderer on the patched
+3.5.x line. Direct MCP consumers also declare the patched SDK minimum so
+standalone installs do not depend on workspace overrides. The shell pins
+Electron 41.10.7; the markdown editor requires ProseMirror View 1.42.3 or later.
+
+After dependency updates, run
+`node --test tools/scripts/test/dependencySecurity.spec.mjs`.
+This checks the lockfile's vulnerable version ranges, standalone SDK minimums,
+and SDK declaration and ESM import compatibility.
+
 ### Docker image
 
 The production [Dockerfile](./Dockerfile) uses Node 24.22.1 on Debian Bookworm,

ts/packages/agentSdkWrapper/package.json

@@ -32,7 +32,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.150",
     "@anthropic-ai/sdk": "^0.93.0",
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/action-grammar": "workspace:*",
     "@typeagent/action-schema": "workspace:*",
     "@typeagent/agent-cache": "workspace:*",

ts/packages/agents/browser/package.json

@@ -59,7 +59,7 @@
     "@lezer/common": "^1.5.2",
     "@lezer/highlight": "^1.2.3",
     "@milkdown/crepe": "^7.3.6",
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/action-schema": "workspace:*",
     "@typeagent/agent-flows": "workspace:*",
     "@typeagent/agent-rpc": "workspace:*",

ts/packages/agents/markdown/package.json

@@ -58,9 +58,9 @@
     "markdown-it-texmath": "^1.0.0",
     "mermaid": "^11.16.1",
     "prosemirror-inputrules": "^1.2.0",
-    "prosemirror-model": "^1.19.0",
+    "prosemirror-model": "^1.25.12",
     "prosemirror-state": "^1.4.2",
-    "prosemirror-view": "^1.31.0",
+    "prosemirror-view": "^1.42.6",
     "typechat": "^0.1.1",
     "unist-util-visit": "^4.1.2",
     "ws": "^8.21.3",

ts/packages/coderWrapper/package.json

@@ -28,7 +28,7 @@
     "tsc": "tsc -b"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/agent-server-client": "workspace:*",
     "@typeagent/dispatcher-types": "workspace:*",
     "node-pty": "^1.0.0"

ts/packages/commandExecutor/package.json

@@ -28,7 +28,7 @@
     "tsc": "tsc -b"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/agent-sdk": "workspace:*",
     "@typeagent/agent-server-client": "workspace:*",
     "@typeagent/config": "workspace:*",

ts/packages/copilot-memory-plugin/package.json

@@ -25,7 +25,7 @@
     "tsc": "tsc -b"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/agent-harness-hooks": "workspace:*",
     "@typeagent/config": "workspace:*",
     "@typeagent/conversation-memory": "workspace:*",

ts/packages/copilot-plugin-eval/package.json

@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "@github/copilot-sdk": "1.0.13",
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/copilot-plugin": "workspace:*",
     "prettier": "^3.5.3"
   }

ts/packages/copilot-plugin/package.json

@@ -31,7 +31,7 @@
     "unregister": "copilot plugin uninstall typeagent"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/agent-harness-hooks": "workspace:*",
     "@typeagent/agent-sdk": "workspace:*",
     "@typeagent/agent-server-client": "workspace:*",

ts/packages/dispatcher/dispatcher/package.json

@@ -49,7 +49,7 @@
     "@azure/cosmos": "^4.2.1",
     "@azure/identity": "^4.10.0",
     "@github/copilot-sdk": "1.0.13",
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@opentelemetry/api": "1.9.0",
     "@typeagent/action-grammar": "workspace:*",
     "@typeagent/action-schema": "workspace:*",

ts/packages/memory/mcp-server/package.json

@@ -30,7 +30,7 @@
     "tsc": "tsc -b"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@typeagent/aiclient": "workspace:*",
     "@typeagent/config": "workspace:*",
     "@typeagent/memory-client": "workspace:*",

ts/packages/security/mcpValidation/package.json

@@ -55,7 +55,7 @@
     "tsc": "tsc -b"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "fast-glob": "^3.3.3",
     "validation": "workspace:*",
     "zod": "^3.24.4"

ts/packages/shell/package.json

@@ -106,7 +106,7 @@
     "cross-env": "^7.0.3",
     "default-agent-provider": "workspace:*",
     "dispatcher-node-providers": "workspace:*",
-    "electron": "41.10.3",
+    "electron": "41.10.7",
     "electron-builder": "26.15.3",
     "electron-builder-squirrel-windows": "26.15.3",
     "electron-vite": "^4.0.1",