crxjs/chrome-extension-tools (@crxjs/vite-plugin)

\n\n### [`v2.7.1`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#271)\n\n##### Patch Changes\n\n- [`efa9c63`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/efa9c63): Update direct dependency ranges for `convert-source-map`, `debug`,\n and `fs-extra`.\n- [`6efde9d`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/6efde9d): Filter Vite 8/Rolldown-only options before the dev file writer calls\n Rollup, removing `Unknown input options: platform` warnings.\n\n### [`v2.7.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#270)\n\n##### Minor Changes\n\n- [`9f00943`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/9f00943): Add dev HMR support for manifest-declared MAIN world content scripts.\n\n##### Patch Changes\n\n- [`a9cc89a`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/a9cc89a): Remove unused vite-plugin dependencies and update selected dependency\n versions.\n\n### [`v2.6.1`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#261)\n\n##### Patch Changes\n\n- [`2b88621`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/2b88621): Coalesce file writer readiness waits so large dev-server graph\n updates do not repeatedly recompute the same dependency traversal. This also\n fixes late HMR readiness waits that could miss the shared ready event and\n delay content script updates.\n\n### [`v2.6.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#260)\n\n##### Minor Changes\n\n- [`4f5d2ec`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4f5d2ec): feat: add IIFE content script bundling\n\n Content scripts named with `.iife.ts` extension are automatically bundled as\n self-contained IIFE files with all dependencies inlined. This is useful for\n MAIN world content scripts used with `chrome.scripting.executeScript` or\n `chrome.scripting.registerContentScripts`.\n\n##### Patch Changes\n\n- [`5316e9c`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/5316e9c): Allow `chrome-extension://` and `moz-extension://` origins in Vite\n dev-server CORS automatically. This keeps extension pages able to fetch\n dev-server files on Vite releases with the stricter localhost-only CORS\n default, including Vite `4.5.6`, `5.4.12`, and `6.0.9+`, without requiring\n projects to configure `server.cors.origin` manually.\n- [`1aee9ad`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/1aee9ad): fix: dynamic content scripts failing in build --watch mode\n- [`2f8bab5`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/2f8bab5): Fix the dev-mode loading page so it waits for the requested extension\n HTML file, preserves the page URL query string, allows extension-origin\n readiness polling, and throttles automatic reloads to avoid rapid flicker.\n- [`1681511`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/1681511): Expand vite-plugin CI to run e2e tests against supported Vite\n versions and fix compatibility issues exposed by the matrix.\n- [`0593d58`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/0593d58): fix: publish ESM declarations for the Vite plugin entrypoint\n\n### [`v2.5.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#250)\n\n##### Minor Changes\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat: add HMR support for CSS declared in manifest content_scripts\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): add: browser_specific_settings.gecko properties\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Fix \"TypeError: plugins is not iterable\" error when using\n rolldown-vite (Vite 7).\n\n In rolldown-vite, the buildStart hook doesn't receive options.plugins. This\n fix uses the configResolved hook to get plugins from the resolved config, with\n buildStart kept as a fallback for older Vite versions.\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Fixed\n [#852](https://redirect.github.com/crxjs/chrome-extension-tools/issues/852), the plugin\n now emits a correct URL in `service-worker-loader.js` when the Vite option\n `server.https` is enabled.\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: resolve TypeScript types correctly for ESM and CJS consumers\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat: add Vite 8 beta support\n\n##### Patch Changes\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): ci: migrate release workflow to npm trusted publishers\n\n- [`570312a`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/570312a): fix: sanitize colons from output filenames on Windows\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: copy CSS files declared in manifest content_scripts to output\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Replace cheerio with node-html-parser to fix npm deprecation warning\n for whatwg-encoding.\n\n Also adds explicit vite peerDependency declaration (^3.0.0 through ^7.0.0) to\n enable proper version resolution when used with different vite versions.\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): ci: run compat tests against stable Vite 8, make the vite8 available\n as a peer dependency\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: UnoCSS/TailwindCSS HMR issues with virtual CSS modules\n\n- [`8a99b4f`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/8a99b4f): made data_collection_permissions optional\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: respect user's build.manifest setting in Vite 4+\n\n When users set `build.manifest: false` in their Vite config, the Vite manifest\n file (`.vite/manifest.json` in Vite 5+, or `manifest.json` in older versions)\n is now properly removed from the output bundle.\n\n CRXJS internally requires the Vite manifest to derive content script resources\n during build, so it forces `build.manifest: true`. Previously, this meant the\n Vite manifest was always included in the output even if the user explicitly\n disabled it. Now, CRXJS removes the manifest from the bundle after processing\n if the user didn't want it.\n\n Closes [#1077](https://redirect.github.com/crxjs/chrome-extension-tools/issues/1077)\n\n- [`d364bd8`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/d364bd8): chore: upgrade chokidar to 5.0.0\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat(client): Update the style and content of the development mode\n loading page\n\n

\n\n

figma/plugin-typings (@figma/plugin-typings)

\n\n### [`v1.141.0`](https://redirect.github.com/figma/plugin-typings/compare/v1.140.0...v1.141.0)\n\n[Compare Source](https://redirect.github.com/figma/plugin-typings/compare/v1.140.0...v1.141.0)\n\n### [`v1.140.0`](https://redirect.github.com/figma/plugin-typings/compare/v1.139.0...v1.140.0)\n\n[Compare Source](https://redirect.github.com/figma/plugin-typings/compare/v1.139.0...v1.140.0)\n\n### [`v1.139.0`](https://redirect.github.com/figma/plugin-typings/compare/v1.138.0...v1.139.0)\n\n[Compare Source](https://redirect.github.com/figma/plugin-typings/compare/v1.138.0...v1.139.0)\n\n

\n\n

figma/rest-api-spec (@figma/rest-api-spec)

\n\n### [`v0.44.0`](https://redirect.github.com/figma/rest-api-spec/compare/2a90e5adc67d8117d7c2da624f03a9bfa3027fb6...v0.44.0)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/2a90e5adc67d8117d7c2da624f03a9bfa3027fb6...v0.44.0)\n\n### [`v0.43.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.42.0...2a90e5adc67d8117d7c2da624f03a9bfa3027fb6)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.42.0...2a90e5adc67d8117d7c2da624f03a9bfa3027fb6)\n\n### [`v0.42.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.41.0...v0.42.0)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.41.0...v0.42.0)\n\n### [`v0.41.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.40.0...v0.41.0)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.40.0...v0.41.0)\n\n

\n\n

jsverse/transloco (@jsverse/transloco)

\n\n### [`v8.4.0`](https://redirect.github.com/jsverse/transloco/blob/HEAD/CHANGELOG.md#840-2026-06-13)\n\n[Compare Source](https://redirect.github.com/jsverse/transloco/compare/bd284ecd5e14ee6b5cbee0d84e3432a749e49d6a...b2b52b3bbcb4d958522e3ccee3e64e422555f8c5)\n\n##### 🚀 Features\n\n- **transloco:** transpile function arguments in FunctionalTranspiler\n\n##### 🩹 Fixes\n\n- translateSignal utility missing injector for toSignal\n- **transloco-scoped-libs:** multi-scope i18n with join strategy\n\n##### ❤️ Thank You\n\n- Dafnik\n- f-aubert\n- Ilshat Khamitov\n\n

\n\n

microsoft/tsdoc (@microsoft/tsdoc)

\n\n### [`v0.17.1`](https://redirect.github.com/microsoft/tsdoc/blob/HEAD/tsdoc/CHANGELOG.md#0171)\n\nTue, 29 Sep 2026 18:52:33 GMT\n\n##### Patches\n\n- Add missing tsdoc-unsupported-html-name to TSDocConfiguration.allTsdocMessageIds so eslint-plugin-tsdoc does not crash when reportUnsupportedHtmlElements is enabled (GitHub [#453](https://redirect.github.com/microsoft/tsdoc/issues/453))\n- Fix an issue where `TSDocEmitter` dropped a line break that appeared before an inline node such as a code span, `{@link}` tag, or HTML element, joining the adjacent words.\n\n### [`v0.17.0`](https://redirect.github.com/microsoft/tsdoc/blob/HEAD/tsdoc/CHANGELOG.md#0170)\n\nWed, 16 Sep 2026 01:24:29 GMT\n\n##### Minor changes\n\n- Update emitter to not replace line breaks\n\n

\n\n

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/server)

\n\n### [`v2.3.1`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.3.1)\n\n[Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.0...@modelcontextprotocol/server@2.3.1)\n\n##### Patch Changes\n\n- Updated dependencies \\[]:\n - [@modelcontextprotocol/core](https://redirect.github.com/modelcontextprotocol/core)@2.3.1\n\n### [`v2.3.0`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/client%402.3.0)\n\n[Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.2.0...@modelcontextprotocol/server@2.3.0)\n\n##### Minor Changes\n\n- [#2901](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2901) [`433eb41`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0) Thanks [@claude](https://redirect.github.com/apps/claude)! - The HTTP client transports and the OAuth client helpers now follow a redirect only when it stays within the origin of the request (same scheme, host and port, or http to https on the same host with default ports) and keeps the method (a 307 or 308, or any redirect of a GET). Any other redirect is not followed. A transport then fails the request with an error that names the target; the session is kept and later messages still send. OAuth metadata discovery moves on to the next well-known URL, and any other OAuth request fails with an error that gives the status. Same-origin redirects that keep the method keep working on Node, up to five in a row, and no code changes are needed there. If your endpoint redirects to another origin, configure the transport with the URL it redirects to. A `requestInit.redirect` of `'error'` or `'manual'` is passed to fetch as it is for the requests a transport sends to the server (POST, GET and DELETE of the Streamable HTTP transport, POST of the SSE transport); for its OAuth requests, and for any other value, `requestInit.redirect` is not consulted by default. Browsers do not expose the target of a redirect to a page, so there a redirected request fails instead of being followed. Setting `redirectPolicy: 'follow'` on a transport leaves its redirects to the fetch implementation, as before this change.\n\n##### Patch Changes\n\n- [#2599](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2599) [`5238fba`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/5238fba4424f82ec1ae9f6f458dd655ab322062d) Thanks [@freya0926](https://redirect.github.com/freya0926)! - A server can now serve, and a client can now call, `tasks/get` and `tasks/cancel` of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when `ctx.era === 'legacy'`.\n\n- [#2846](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2846) [`63c0fca`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/63c0fcab49dc13f22dd7d016d6320c62d05e3ca8) Thanks [@Sthreal](https://redirect.github.com/Sthreal)! - Receiving a large message as a single SSE event over Streamable HTTP, such as a tool result of tens of megabytes, is now fast: a 50 MB result that took about 13 seconds arrives in under a second. The client now requires `eventsource-parser` 3.0.8 or later. `SSEClientTransport` reads through the `eventsource` package and gets the same speed-up once that also resolves `eventsource-parser` 3.0.8 or later.\n\n- [#2908](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2908) [`633dd3e`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1) Thanks [@claude](https://redirect.github.com/apps/claude)! - The `license` field of the package manifests is now `Apache-2.0`; the `LICENSE` file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.\n\n- [#2903](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2903) [`e765b3b`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/e765b3be84b7eba1837ba8da84acd6898cc47c65) Thanks [@claude](https://redirect.github.com/apps/claude)! - With `versionNegotiation` in `'auto'` or pin mode, a `server/discover` probe answered with a 2xx that carries no usable reply (a body that\n is not JSON under `application/json`, a bare `204`, a missing or unaccepted content type) still rejects `connect()` with\n `EraNegotiationFailed`; an empty SSE stream or a `202` surfaces as the probe timeout instead. The message now says\n `the server answered with an unusable reply (...)` instead of reading like a network failure. To connect to a 2025 server behind a front that\n answers the probe this way, pass `connect(transport, { prior: { kind: 'legacy' } })` or use `mode: 'legacy'`.\n\n- [#2905](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2905) [`c0cd01a`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/c0cd01a21d867e57b29d7216416b25bf36898292) Thanks [@claude](https://redirect.github.com/apps/claude)! - `SSEClientTransport` now retries the SSE connection once after `onUnauthorized()` resolves, as documented. If the retry is also answered with 401, `start()` rejects with `SdkHttpError` (`ClientHttpAuthentication`) instead of calling `onUnauthorized()` again. A 401 on a later reconnect of a stream that had opened still gets one refresh.\n\n- Updated dependencies \\[[`633dd3e`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/633dd3e12bff6869c932c4a526341622320912b1)]:\n - [@modelcontextprotocol/core](https://redirect.github.com/modelcontextprotocol/core)@2.3.0\n\n### [`v2.2.0`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/client%402.2.0)\n\n[Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.1.0...@modelcontextprotocol/server@2.2.0)\n\n##### Minor Changes\n\n- [#2887](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2887) [`edd12e2`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd) Thanks [@maxisbey](https://redirect.github.com/maxisbey)! - Constructing `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or `CrossAppAccessProvider` without `expectedIssuer` is deprecated: the constructor logs one `console.warn` and that call signature is marked `@deprecated`. Behaviour is otherwise unchanged. Pass the `issuer` of the authorization server the credentials were registered with.\n\n `fetchToken()` throws `AuthorizationServerMismatchError`, before sending anything, when the provider's client information is bound to a different authorization server than the one it is called with. The `AuthorizationServerMismatchError` message no longer assumes the authorization-code callback; its fields are unchanged.\n\n `OAuthTokensSchema` and `OAuthClientInformationSchema` accept the optional `issuer` stamp, so a provider that reads storage back through them keeps it. `auth()` overwrites it on every save.\n\n##### Patch Changes\n\n- [#2885](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2885) [`9dd722f`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/9dd722fd0b533b3cb44cd2834409f7ea4dd32b00) Thanks [@claude](https://redirect.github.com/apps/claude)! - Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection (seen as `unhandledrejection` on Cloudflare Workers) in addition to the returned rejection.\n\n- [#2883](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2883) [`c0f7aec`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/c0f7aec2925a46b32dc2f2aad5bf636a36f02c78) Thanks [@claude](https://redirect.github.com/apps/claude)! - Fix a type-check failure for CommonJS TypeScript projects introduced in 2.1.0: `dist/index.d.cts` imported types from `jose`, which is ESM-only, so `tsc` with `module: node16`/`node18` and `skipLibCheck: false` failed with TS1479. The two `jose` types used by the DPoP API (`CryptoKey`, `JWK`) are now inlined into the declaration files. No runtime change.\n\n- [#2768](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2768) [`efebf5b`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/efebf5b2ba2f07c6fa27ada824a0999b801fec0a) Thanks [@web-abin](https://redirect.github.com/web-abin)! - Correct the JSDoc for insecure OAuth token endpoints. The TLS requirement comes from the MCP authorization specification's OAuth 2.1 communication-security rules, not SEP-2207, which covers OIDC-flavored refresh-token guidance. Documentation only; no runtime behavior change.\n\n- [#2729](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2729) [`a4ae2f9`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/a4ae2f98da3814a9290f2791cfcca8148dcec978) Thanks [@claude](https://redirect.github.com/apps/claude)! - Correct the `registerClient` `@deprecated` notice: Dynamic Client Registration was deprecated by spec PR [#2858](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2858) (Client ID Metadata Documents), not SEP-2577 (which deprecates roots, sampling, and logging). The notice now also names the earliest possible removal date under the feature lifecycle policy (2027-07-28) and clarifies that the `client_id_metadata_document_supported` gating lives in the built-in `auth()` flow — `registerClient` called directly always sends the registration request. Documentation only; no runtime behavior change.\n\n- [#2862](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2862) [`e780e13`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/e780e13869ad419a864b669bd5fa9702cfb36b14) Thanks [@SyedTashfin](https://redirect.github.com/SyedTashfin)! - Preserve `_meta` on `input_required` results. The 2026-07-28 decode seam rebuilt the payload from `inputRequests` and `requestState` only, so result-level metadata a server sent on an `input_required` result (including `io.modelcontextprotocol/serverInfo`) was dropped before an `allowInputRequired: true` caller could see it. `Result._meta` is a result-level field, so `input_required` carries it exactly like any other result.\n\n- [#2886](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2886) [`ef39308`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/ef39308e963496b75e50553f6265d99cacb4fbb9) Thanks [@claude](https://redirect.github.com/apps/claude)! - `listTools()`, `listPrompts()`, `listResources()` and `listResourceTemplates()` called without a cursor now follow `nextCursor` until the server stops sending one, instead of stopping silently with a short list when a cursor repeats; a page that has the same items and the same `nextCursor` as the page before it ends the walk and is not added twice, and `listMaxPages` still caps the walk.\n\n- [#2642](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2642) [`cfa09db`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/cfa09db614308eaf4fd575c89833da8878d4acb7) Thanks [@claude](https://redirect.github.com/apps/claude)! - Fix `Client.listen()` rejections escaping as process-level unhandled rejections. The internal `opening` promise could reject (ack timeout, transport close, server cancel, caller abort) while `listen()` was still serially awaiting `transport.send(...)`, so no rejection handler was attached yet — the rejection surfaced as an `unhandledRejection` that caller-side handling cannot prevent, and a send that never settles (e.g. a stdio write parked on `'drain'`) left `listen()` suspended forever even though the ack timer had already fired. `listen()` now suspends on the `opening` state machine directly and routes send failures into it, so every termination path rejects the returned promise and nothing escapes.\n\n- [#2597](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2597) [`7f7a94c`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/7f7a94c22017e121a960e071bb50ec75e34450bd) Thanks [@arimu1](https://redirect.github.com/arimu1)! - Treat hostnames ending in `.localhost` as loopback for the SEP-2207 token-endpoint https guard (RFC 6761 §6.3), so host-based multi-tenant local OAuth works. The SDK does not resolve the name itself: `*.localhost` reaches the local machine only if the system resolver follows RFC 6761.\n\n- Updated dependencies \\[[`edd12e2`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd)]:\n - [@modelcontextprotocol/core](https://redirect.github.com/modelcontextprotocol/core)@2.2.0\n\n### [`v2.1.0`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/client%402.1.0)\n\n[Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.0.0...@modelcontextprotocol/server@2.1.0)\n\n##### Minor Changes\n\n- [#2629](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2629) [`dcc0102`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/dcc01028ff6a499a5728c2b6181c1727d52e2fab) Thanks [@gbshankar](https://redirect.github.com/gbshankar)! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client.\n - Opt in by implementing `OAuthClientProvider.dpop()` returning a `DpopSession` (new, along with `generateDpopKeyPair`, `accessTokenHash`, `isDpopNonceChallenge`). `auth()` / `exchangeAuthorization` / `refreshAuthorization` / `fetchToken` then sign a DPoP proof into token requests (retrying once on an authorization-server `use_dpop_nonce` challenge, with client authentication re-applied per attempt), and `StreamableHTTPClientTransport`, `SSEClientTransport` and `withOAuth` present a `token_type: \"DPoP\"` access token as `Authorization: DPoP ` plus a fresh per-request proof, retry a resource-server `use_dpop_nonce` challenge once, and pick up a `DPoP-Nonce` delivered on any response. Tokens the AS issued as `Bearer` are still presented as Bearer.\n - DPoP is applied at the fetch layer: the transports wrap their resource-server `fetch` (including a caller-supplied `fetch` / `eventSourceInit.fetch`) with the new `withDpopFromProvider(provider)` middleware, so proofs are always bound to the request actually sent. `withDpop(session, getToken)` is exported for callers that manage tokens themselves (e.g. alongside a minimal `AuthProvider`); the `AuthProvider` interface itself is unchanged.\n - `auth()` now recovers from `invalid_dpop_proof` on refresh (e.g. a refresh token bound to a key that is no longer held) by discarding the tokens and re-authorizing, like `invalid_grant`. `OAuthErrorCode` gains `InvalidDpopProof` and `UseDpopNonce`; `extractWWWAuthenticateParams` recognizes the `DPoP` challenge scheme; `OAuthMetadataSchema` gains `dpop_signing_alg_values_supported`.\n\n##### Patch Changes\n\n- [#2726](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2726) [`6fa4227`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/6fa42279fecaba423635072f716bbb2f6f7c77f3) Thanks [@LuckTerence](https://redirect.github.com/LuckTerence)! - `SdkError` and `SdkHttpError` accept standard `ErrorOptions` as an optional fourth constructor argument and forward it to `Error`, so a wrapped error is reachable through the standard `Error.cause` chain. Version-negotiation probe failures (`SdkErrorCode.EraNegotiationFailed`) now use it: the underlying `TypeError: fetch failed` and the DNS or socket error beneath it surface via `error.cause`, so pino, Sentry, and `util.inspect` render `ENOTFOUND` / `ECONNREFUSED` / `ETIMEDOUT` instead of stopping at the `SdkError` ([#2657](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2657)). The previous `error.data.cause` slot is still populated for compatibility but is deprecated and slated for removal; read `error.cause` instead.\n\n- [#2654](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2654) [`03842cd`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/03842cd9cae9a9b142c77d2fb65e829fc4e03eab) Thanks [@pshah19](https://redirect.github.com/pshah19)! - Treat request id `0` as a real id. Two guards tested a `RequestId` for truthiness, so the legal JSON-RPC ids `0` and `''` were read as absent. Id `0` is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first `sampling/createMessage`, `elicitation/create`, or `roots/list` a server sends.\n\n - `notifications/cancelled` carrying id `0` was ignored, and the in-flight handler ran to completion with its `AbortSignal` never fired.\n - A notification sent with `relatedRequestId: 0` wrongly passed the debounce gate (for methods opted into `debouncedNotificationMethods`). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.\n\n Absent is now the only value that means \"no id\".\n\n- [#2043](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2043) [`c4248a9`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/c4248a935f245a86b2fb8b88b9c3d594e2bfea75) Thanks [@ChrisJr404](https://redirect.github.com/ChrisJr404)! - On Windows, stdio servers spawned by `StdioClientTransport` now also inherit `COMSPEC`, `PATHEXT`, `PROGRAMDATA`, `PROGRAMFILES(X86)`, `PROGRAMW6432`, and `WINDIR` (added to `DEFAULT_INHERITED_ENV_VARS`). Programs a server launches can depend on them: PowerShell finds no native executables without `PATHEXT`, and Windows OpenSSH exits 255 without `ProgramData`.\n\n- [#2668](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2668) [`3e90449`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/3e90449fd52997da43b79a536d2c19c446603cc7) Thanks [@KKonstantinov](https://redirect.github.com/KKonstantinov)! - Stop sending `notifications/cancelled` for the `initialize` handshake. The spec is explicit that a client MUST NOT attempt to cancel its `initialize` request, but the outbound cancel path fired for any in-flight request: aborting the `AbortSignal` passed to `connect()`, or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.\n\n The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and `connect()` still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.\n\n- [#2475](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2475) [`b654261`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/b65426158ed9f29aea8ef3dc09ca22d7d9d6f970) Thanks [@sanjibani](https://redirect.github.com/sanjibani)! - `StreamableHTTPClientTransport` and `SSEClientTransport` now give their transport-managed headers precedence over same-named entries in `requestInit.headers`: `Authorization` when `authProvider` yields a token, `mcp-protocol-version`, and (Streamable HTTP) `mcp-session-id`. Header names compare case-insensitively and every `HeadersInit` form is covered (plain object, tuple array, `Headers` instance). Previously the caller-supplied value won, so a static `Authorization` placeholder (e.g. an env-var API key) kept overriding the OAuth token even after the provider obtained one and the fallback-to-OAuth flow never completed; a `Headers` instance or lowercase key produced a combined `Bearer , Bearer ` value instead. A configured `Authorization` is still sent while the provider has no token, and other configured headers pass through unchanged. Closes [#2208](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2208).\n\n- [#2581](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2581) [`5119ee7`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/5119ee7fd7790e335a3fb60ef36f85334e2a6326) Thanks [@hugosmoreira](https://redirect.github.com/hugosmoreira)! - Preserve the exact OAuth resource indicator from protected resource metadata when building authorization and token requests. Previously a pathless `resource` such as `https://example.com` was normalized to `https://example.com/` via `URL.href`, which breaks authorization servers that require the `resource` parameter to match the published value exactly (Microsoft Entra ID rejects it with `AADSTS9010010`). The exported OAuth helpers (`startAuthorization`, `exchangeAuthorization`, `refreshAuthorization`, `fetchToken`, `executeTokenRequest`) now also accept a `string` for `resource`; `selectResourceURL` still returns a `URL`, and a provider's `validateResourceURL` result is used unchanged. Fixes [#1968](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1968).\n\n- [`3924de9`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/3924de99df834302d89f5997a1b64ca268282284) - Let `saveTokens` failures surface after a successful token refresh. In `auth()`, one `try`\n wrapped both `refreshAuthorization()` and the `provider.saveTokens()` that persists its\n result, and the `catch` deliberately swallows anything that is not an `OAuthError` — plus\n `ServerError` — so that a failed refresh falls through to a fresh authorization request.\n A persistence error thrown by the provider landed in that same branch: it was discarded\n with no log and no rethrow, and `auth()` continued to `startAuthorization()` and returned\n `'REDIRECT'`.\n\n Against an authorization server that rotates refresh tokens (the OAuth 2.1 default, and\n Keycloak's) this loses credentials rather than merely hiding an error. The exchange has\n already succeeded server-side, so the old refresh token is invalidated at the moment the\n new one is issued; dropping the new token set leaves nothing usable on either side. On a\n headless or CLI client, where `redirectToAuthorization` is typically a no-op, the fallthrough\n is silent and the client is left with stale tokens and no indication of why.\n\n The `try`/`catch` now covers only `refreshAuthorization()`. Persisting the result happens\n after it, on an unguarded path, so a provider's I/O error propagates to the caller.\n\n Refresh-request failures keep their existing control flow exactly: a `ServerError` or an\n unknown error still falls through to a new authorization flow, a non-`ServerError`\n `OAuthError` is still rethrown, and `InsecureTokenEndpointError` is still surfaced. The\n SEP-2352 `issuer` stamp written with the refreshed tokens is unchanged.\n\n Those fallbacks no longer happen in silence, though. Both routes to an unexplained\n re-authorization now emit a `console.warn` naming the cause: the in-place fallthrough in\n the refresh block, and `auth()`'s outer recovery for `invalid_grant`, `invalid_client`,\n and `unauthorized_client`, which discards stored credentials and retries. The second one\n matters most in practice — an expired, revoked, or rotation-reuse-detected refresh token\n is reported as `invalid_grant`, which is precisely the state a dropped token set leaves\n behind for the next call.\n\n Consumers whose `OAuthClientProvider.saveTokens` can reject should note that `auth()` may\n now reject where it previously returned `'REDIRECT'` — that rejection is the failure that\n was being discarded.\n\n- [#2613](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2613) [`70de0c8`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/70de0c8b569b0d664a56b90be2f141d1d1645880) Thanks [@jwcarman](https://redirect.github.com/jwcarman)! - Emit and validate the `Mcp-Name` header for tasks requests per SEP-2663's Streamable HTTP binding: the client transport now mirrors `params.taskId` into `Mcp-Name` on `tasks/get` / `tasks/update` / `tasks/cancel` (previously omitted, causing conforming servers to reject every task poll with `-32020 HeaderMismatch`), and the server-side standard-header validation cross-checks it via the same shared `MCP_NAME_HEADER_SOURCE` table.\n\n On the server, `createMcpHandler` now answers a modern (2026-07-28) `tasks/get` / `tasks/update` / `tasks/cancel` POST that omits `Mcp-Name`, or whose header disagrees with `params.taskId`, with `400` / `-32020` (`HeaderMismatch`) at the `standard-header-validation` rung, the same treatment `tools/call` / `prompts/get` / `resources/read` already get. Legacy-era (2025-11-25) tasks traffic is unaffected. Clients built with this SDK release send the header; hand-rolled clients that omitted it must add it.\n\n- Updated dependencies \\[[`dcc0102`](h\n\n> [!IMPORTANT]\n> ✂ PR body was truncated to here.\n\n\n

\n\n---\n\n### Configuration\n\n📅 **Schedule**: (in timezone Europe/Paris)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 **Automerge**: Enabled.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/AmadeusITGroup/otter).\n\n","b6780399ecd94e7abf8a5976e4eda7ed15ca905e","31da3deaf8c0a53b92eec04e344bc6faa0a4bae9",{"_432":433,"_434":435,"_436":-5,"_437":438,"_439":-5,"_440":441,"_442":-5,"_443":-5,"_444":-5,"_445":-5,"_446":447,"_448":-5,"_449":-5,"_450":-5,"_451":-5,"_452":-5,"_453":-5,"_454":-5,"_455":-5,"_148":456,"_457":-5,"_458":-5,"_386":-5,"_459":-5,"_460":-5,"_461":462,"_463":-5,"_464":-5,"_465":-5,"_466":-5,"_467":-5,"_468":-5,"_469":-5,"_470":-5,"_471":-5,"_472":473,"_474":-5,"_475":-5,"_476":-5},"suggestedFixId","6acfe48b6caa5f310a6ed413","fixedTasks",[],"otherFailedTasks","verificationStatus","NOT_STARTED","verificationTasksExecuted","userAction","NONE","userActionOrigin","userCommitMessage","suggestedFix","suggestedFixDescription","suggestedFixStatus","TIMED_OUT","suggestedFixReasoning","suggestedFixExecutionTime","verificationExecutionTime","reviewComment","originalSuggestedFix","originalSuggestedFixDescription","originalSuggestedFixReasoning","userActionRecordedAt",["D",1792009355658],"suggestedAt","verifiedAt","failureClassification","fileModeMap","suggestedFixFailureReason","Request timeout: The request was ended after 9 minutes","suggestedFixFailureReasonDetails","suggestedFixFailureReasonType","assignedAgentName","autoApplySkipped","autoApplySkipReason","flakyRerunSkipped","flakyRerunPending","confidence","confidenceReasoning","fixApplicationAttempts",[],"taskOutputSummary","remoteTaskSummary","localTaskSummary",{"_479":487,"_481":482,"_483":-5,"_484":-5,"_485":-5,"_486":-5},{"_479":480,"_481":482,"_483":-5,"_484":-5,"_485":-5,"_486":-5},"taskName","chrome-devtools:build-components","runLinkId","VbUFhjCHUb","dteExecutionId","agentName","launchTemplates","taskTarget","ama-mcp-core:compile","AmadeusITGroup",["D",1676054118998],["D",1681913345534],"allowedEmailDomains",[552],"planActivationDate",["D",1686144031537],"isEligibleForProTrial","planLimits",{"_536":537,"_538":539,"_540":541,"_542":543,"_544":543,"_545":546,"_547":548,"_549":548,"_550":551},"isAiEnabled","planTransitions",[],"id","memberships",[516,517,518,519,520,521,522,523],"privateCloudInstallationId","hasBillingInformation","hasLicense","isUnclaimed","isOnTrial","isHighPriority","vcsProfileLink","vcsConfiguration","lastMembersSyncedAt","isAiBringYourOwnKey","enterpriseTrial","disabledReasonMessage",{"_524":535,"_526":527},{"_524":534,"_526":529},{"_524":533,"_526":527},{"_524":532,"_526":529},{"_524":531,"_526":529},{"_524":530,"_526":529},{"_524":528,"_526":529},{"_524":525,"_526":527},"userId","63eb8f0c1147ed000ed89147","role","admin","656f2a38d8c7f6f8d5bfdab5","member","64a51a42097e04000dcff5a3","63f5d0d76abadd000e2a636a","63ee2a741147ed000ed892b0","63ecec5bd91fa9000e2ebaa1","63ecec62d91fa9000e2ebaa3","63e68de49bae37000e41c9c6","baseIncludedCredits",300000,"additionalCredits",{},"discountedCreditsMaximum",0,"contributorLimit",70,"concurrentConnectionLimit","runsLimit",1000000,"adminUserLimit",9999,"workspaceLimit","modifiers",[],"amadeus.com",["D",1792008487282],["D",1792009956124],["D",1792009956124],[],[],[],[],{},{},{},{"_77":564,"_79":-5},{"_90":565,"_92":566,"_94":567,"_96":568},{"_129":589,"_131":590,"_133":591},{"_121":583,"_123":584},{"_104":572,"_106":573,"_80":574,"_82":575},{"_98":569},[570],{"_73":101,"_102":571,"_79":-5},[],[582],[],[579],[576],{"_73":111,"_102":577,"_79":-5},{"_113":114,"_86":578},[],{"_73":111,"_102":580,"_79":-5},{"_113":117,"_118":581},[],{"_73":111,"_102":22,"_79":-5},[587],[585],{"_73":111,"_102":586,"_79":-5},[],{"_73":111,"_102":588,"_79":-5},[],[595],[594],[592],{"_73":101,"_102":593,"_79":-5},[],{"_73":101,"_102":22,"_79":-5},{"_73":101,"_102":139,"_79":-5},["D",1792008487282],["D",1792009956563],["D",1792009956124],[613],{"_188":295,"_296":295,"_297":298,"_299":300,"_301":-5,"_302":-5,"_303":304,"_305":306,"_307":308,"_309":310,"_311":312,"_313":314,"_315":316,"_317":318,"_319":-5,"_320":-5},[],[226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,23,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294],[],{"_41":607,"_43":608,"_45":28},{"_220":221,"_222":223,"_224":606},["D",1792008897186],{"_62":-5,"_63":-5},{"_46":22,"_47":22,"_48":22,"_49":28,"_50":22,"_51":609,"_53":-5,"_54":-5,"_55":610,"_57":611,"_59":612,"_61":-5},[],[],[],[],{"_79":146,"_15":147,"_148":553,"_150":554,"_152":555,"_154":155,"_156":-5,"_157":22,"_158":-5,"_159":-5,"_160":-5,"_161":556,"_163":22,"_164":165,"_166":28,"_167":614,"_169":558,"_80":559,"_172":-5,"_173":560,"_175":615,"_177":562,"_179":-5,"_180":28,"_181":182,"_183":563},[],{},["D",1676055838344],"type","PRIMARY","publicCloudCounterpartId","privateCloudCounterpartId","installationSource","user","remoteSourceIntegrationType","GITHUB_EVENTLESS","featureMarkers",{"_659":22,"_660":28,"_661":22},"manualSetAccessLevel","idAccessLevel","READ_ONLY","patAccessLevel",{"_652":318,"_653":654,"_655":656,"_657":658},"flakyTaskConfiguration",{"_648":649,"_650":651},"aiTaskFixingConfiguration",{"_46":22,"_47":22,"_48":22,"_49":28,"_50":22,"_51":644,"_54":-5,"_55":645,"_57":646,"_59":647},"enableWorkspaceDataCaching","showVcsStatusChecks","defaultBranch","main","visibility","ALLOW_UNAUTHENTICATED","sandboxingConfiguration","launchTemplate",[],[],[],[],"threshold","NORMAL","samplePeriodDays",28,"provider","repositoryFullName","AmadeusITGroup/otter","repositoryId","589619867","repositoryVisibility","PUBLIC","isRemoteCachingActive","isDistributedTaskExecutionActive","isVCSIntegrationActive","currentUser","currentHostname","cloud.nx.app","incident",["P",666],"notifications",["P",668],"isSystemAdmin","isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6acfe1276caa5f310a6e0570/configurations/config-yaml?runGroup=38628913415-1","deferredUserOrganizations",["P",680],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_751":22,"_351":28,"_752":22,"_753":22,"_754":22,"_755":756,"_757":758,"_759":28,"_760":761,"_762":763,"_693":764},"posthogBootstrap",{"_721":722,"_723":724},"ultracacheUiEnabled","pylon",{"_713":714,"_715":716,"_71":717,"_718":-7,"_719":720},"requestInfo",{"_697":698,"_84":350,"_88":699,"_700":701,"_702":703},"hints",{"_706":709,"_711":712},"/cipes/6acfe1276caa5f310a6e0570/configurations/config-yaml","url","https://cloud.nx.app/cipes/6acfe1276caa5f310a6e0570/configurations/config-yaml","userPreferences",{"_704":705},"theme",{"_71":182,"_706":707,"_708":709,"_710":709},"variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","d663cad0-35a6-4d24-85c8-8171a6501c52@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","ebc76677053b51de7a0386b8a467aecee6604ee9af88d7cc55b6d8ee7d562b83","distinctID","d663cad0-35a6-4d24-85c8-8171a6501c52","featureFlags",{"_725":22,"_726":22,"_727":728,"_729":22,"_730":46,"_731":22,"_732":22,"_733":28,"_734":28,"_735":22,"_736":22,"_737":22,"_738":739,"_740":22,"_741":22,"_742":28,"_743":22,"_744":22,"_745":28,"_746":46,"_747":22,"_748":22,"_749":750},"non_dte_resource_usage","resource_addon_default","one_page_connect_workspace_manual","test","pylon_chat","one_page_connect_workspace_gitlab","show_setup_self_healing_ci_alert","workspace_badges","cipe_execution_timeline","run_details_polling","demo-mode","config_yaml","automated_add_ons","cnw_empty_workspace_position","treatment","resource_usage_toggle","workspace_rewind","new_layout","teams_minimum_spend","workspace_sandboxing_toggle","feature_activation_guide","one_page_connect_workspace_github","survey-targeting-8e88152ae4-custom","new_access_control","welcome_view_cnw_experiment","variant-2","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_783":774,"_349":350},"auth0",{"_777":778,"_779":780,"_781":782},"e2eTestMode","rollbar",{"_769":770,"_771":772,"_46":22,"_773":774,"_775":22,"_776":22},"posthog",{"_765":766,"_767":768},{"_713":714},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.14.0002","captureUncaught","captureUnhandledRejections","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]

Config YAML