chore(deps): monthly dependency refresh #2557

Activity

1. github-actions

   added this to the v2.10.0 milestone on Oct 1, 2026
2. github-actions

   added

   v2Issues and PRs for v2Issues and PRs for v2

   choreMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior changeMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior change

   dependabot

   on Oct 1, 2026
3. cliffhall

   modified the milestones: v2.10.0, v2.11.0 on Oct 7, 2026
4. cliffhall commented on Oct 7, 2026

   

   cliffhall

   on Oct 7, 2026

   Member

   More actions

   Triage: Priority Low (total 5)

   • Severity 2 — routine refresh; no advisory or breakage driving it
   • Urgency 2 — wanted eventually, nothing blocked on it
   • Bonuses: +1 milestone (approved into v2.11.0)

   Board: #28, Status Todo, milestone v2.11.0.
5. cliffhall commented on Oct 13, 2026

   

   cliffhall

   on Oct 13, 2026

   Last edited by cliffhall

   Member

   More actions

   Refresh analysis — what moved, what stayed, and why (2026-10-12)

   Written so the next sweep can reuse it: most of the held items below will be suggested again, and each has a revisit when line saying what would change the answer.

   Baseline: npm audit reported zero advisories on the then-current versions in all five installs (root, web, tui, cli, mcpdo). Nothing here was a security fix; the case for every move is staying current or a specific benefit named below.

   Method: each candidate was installed on a trial branch and run through npm run local:gate, plus verify:dep-lockstep. Behavior changes the gate can't see were checked by hand against release notes (details per row).

   ---

   ✅ Taken

   Package	From → To	Why
   In-range ("wanted") bumps — hono, @hono/node-server, vite, @vitejs/plugin-react, eslint, typescript-eslint, globals, zod, ajv, yaml, express, react / react-dom 19.3, @types/react{,-dom}, Storybook 10.6, Playwright 1.64, Testing Library patches, tsx, papaparse, react-syntax-highlighter, eslint-plugin-*, @types/node 24.x	lockfile only	Accumulated fixes; staying within declared ranges keeps later majors small. Do this with targeted npm update <pkg …>, not a bare npm update: a whole-tree update re-resolved transitives and hoisted ajv 6, typescript 6 and commander 4 into client installs, creating new lockstep skews. Peer/transitive shadows also have to be moved by hand (eslint, react, zod in tui; eslint, zod in web).
   @types/node (web, transitive)	override ^24.12.4	Not an upgrade but a pin: @types/express depends on @types/node: *, so web's copy floated to 26.x and broke lockstep. Same overrides fix cli already carries.
   ink-form	2.0.1 → 2.0.2 (floor raised to ^2.0.2)	Upstream fixed the "you have not competed yet" typo (lukasbach/ink-form#14). Our build-time label patch is designed to fail when the typo disappears, and it did, so the patch, its tests and its README section are deleted. The floor is raised so no install can resolve the misspelled release.
   @napi-rs/keyring	1.3 → 2.1	The one upgrade that fixes something in our code. v1 resolved a locked, inaccessible or permission-denied keychain as null / false, the same as "nothing stored". core/auth/node/secret-store.ts was written assuming those failures throw: getStrict ("a keychain that cannot answer must not be reported as an empty one"), probeKeyringAvailable, and delete ("Only an unavailable keychain throws"). v2 rejects on store errors, which makes that true. The tolerant get() already catches, so it is unaffected. API surface is unchanged (AsyncEntry, getPassword/setPassword/deleteCredential, findCredentialsAsync), and a real set/get/find/delete round-trip on the macOS keychain passed.
   commander	13 → 15	Commander 15 is current and 14 is maintenance-only (security fixes to May 2027), so 13 is likely past support. 15 is ESM-only (we bundle, so no effect) and needs Node ≥22.12 (we require ≥22.19). Its one behavior change is that a --no-* default is only implied for a lone negative option. Our only one, --no-revoke, has no --revoke counterpart, so it is unaffected. ⚠️ Two edits: the root range and mcpdo's overrides.sucrase.commander, which deliberately pins sucrase's copy to the root's major so mcpdo's own import "commander" resolves the same version. Moving only the root fails lockstep.

   ⏸️ Tried, works, but deliberately not taken

   Package	Latest seen	Why not	Revisit when
   vitest 5 (+ @vitest/coverage-v8, @vitest/browser-playwright, web's vitest override, all exact)	5.0.4	⚠️ It silently breaks the coverage gate. v5 fixed "coverage include/exclude globs too eager", and our web include patterns (src/components/**, absolute core/… paths) stopped matching. The web coverage report went from 418 files to 11, the ≥90 per-file gate checked only those 11, and local:gate went green. Separately, two auth tests assigned global.sessionStorage directly, which v5's getter-only globals reject (fix: vi.stubGlobal). Its other changes are stricter but welcome: an un-awaited async assertion fails the test, expect.poll fails on timeout, mocks are cleared before each test.	Do it as its own issue: rewrite the coverage globs relative to the coverage root, and verify the per-client file counts match before and after (web 419 / cli 20 / tui 41 / mcpdo 31 / launcher 1 on the kept set of this refresh). The gate has no guard for a shrinking coverage scope: #2709, which should land first.
   prettier (exact pin)	3.9.10	Its 3.9 union-type layout reformats ~50 files. That diff conflicts with every open branch and buys us nothing we need.	Land it alone at a quiet moment (e.g. right after a release), as a pin bump plus npm run format with no other changes.
   pino	10.4	10.0's only change is dropping Node 18. No benefit and no cost.	When 9.x stops getting fixes, or a 10.x feature is wanted.
   @testing-library/jest-dom	7.0	Adds matchers we don't use; requires Node 22 and an explicit @testing-library/dom peer. No value.	When we want toContainAnyBy* / toContainOneBy*.
   happy-dom	21.0	21.0's breaking change is SSRF hardening (no CSS/iframe loading by default). That doesn't apply to us, since it only runs our own HTML in tests. It reduces test fidelity: "Iframe page loading is disabled" appeared in our test output, so iframe-touching tests may check less while still passing.	Only together with an audit of iframe-dependent tests, possibly setting enableIframePageLoading.
   @dnd-kit/sortable	10.0	Passed the gate, but no release notes could be found for 9 or 10 and we have no known need.	When someone has a concrete reason; check the changelog first.
   anthropics/claude-code-action (SHA pin)	v1.0.248	It runs in sdk-watch.yml's analyze job, which holds ANTHROPIC_API_KEY, so every bump brings new third-party code next to a credential. The 13 intervening releases were not reviewed.	Bump after reading the intervening release notes; resolve the SHA and the # vX.Y.Z comment from the same tag lookup (verify:action-pins).

   ❌ Not taken — blocked or needs a decision

   Package	Latest seen	Why not	Revisit when
   @mantine/* 9	9.7.2	Breaks, but the migration is bounded. (1) Collapse prop in → expanded (9 call sites; the only type error). (2) v9's Autosize textarea calls document.fonts.addEventListener, which happy-dom lacks, so the test setup needs a document.fonts polyfill. (3) Select's input now has role="combobox" instead of textbox, so ~59 test queries change. With (1) and (2) applied, all remaining failures were (3). Also Collapse now keeps content mounted by default via React 19 Activity, which needs a visual and Storybook pass.	Its own issue/PR with screenshots.
   ink 7 / 8 (+ ink-scroll-view 0.4, which needs ink ^7)	8.0.0	Works functionally: typecheck, build and 635/636 TUI tests pass. The one failure is the deliberate guard in clients/tui/__tests__/tsupConfig.test.ts. ink is left unbundled on the premise that the root react: ^19.0.0 range lets npm dedupe with any React 19 a consumer has, and the guard asserts ink's React peer floor is >=19.0.0. ink 7 requires >=19.2.0 and ink 8 >=19.3.0.	Needs a decision: raise the root react floor (consumers on older 19.x hit the #1952 split-React crash) or bundle ink (~+1.4 MB).
   chokidar 5	5.0.0	tsup depends on chokidar ^4 in every client install. verify:dep-lockstep only tolerates skew within one major, and overriding tsup onto a chokidar major it doesn't declare isn't worth it for no benefit.	When tsup widens to chokidar 5.
   open 11	11.0.4	Same shape: Storybook depends on open ^10 in web.	When Storybook moves to open 11.
   typescript 7	7.0.2	typescript-eslint (8.71) peers typescript >=4.8.4 <6.1.0.	When typescript-eslint supports TS 7. (TS 6.0 was not evaluated.)
   @types/node 25 / 26	26.6.5	Our engine floor is Node ≥22.19, so node type definitions shouldn't advertise APIs newer than what we support. Already at 24, which is ahead of the floor.	Only when the engines floor rises.

   Gotchas worth remembering next time

   • A green gate does not prove a coverage-tool upgrade is safe. Compare coverage/coverage-summary.json file counts per client before and after.
   • Read the release notes for anything behind a mock. The keyring semantic change was invisible to the gate because the secret-store tests mock the binding.
   • mcpdo's overrides.sucrase.commander must move with the root commander range.
   • web needs overrides["@types/node"] (as cli has), or @types/express drags the newest major in.
6. cliffhall

   self-assigned this

   on Oct 13, 2026
7. cliffhall

   linked a pull request that will close this issuechore(deps): October dependency refresh (#2557) #2710on Oct 13, 2026
8. cliffhall

   added a commit that references this issue on Oct 13, 2026

   Merge pull request #2710 from modelcontextprotocol/v2/chore/2557-mont…

   ...

   a6aa805
9. cliffhall commented on Oct 13, 2026

   

   cliffhall

   on Oct 13, 2026

   Member

   More actions

   Shipped in #2710 (merged as a6aa805 on v2/main).
10. cliffhall

    closed this as completedon Oct 13, 2026