chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650

Merged
felixweinberger merged 6 commits into
mainfrom
chore/hono-lockfile-refresh
Mar 13, 2026
Merged

chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom
chore/hono-lockfile-refresh

Conversation

@felixweinberger

@felixweinbergerfelixweinberger commented Mar 9, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).

Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).

Also drops stale minimumReleaseAgeExclude entries.

@changeset-bot

changeset-botBot commented Mar 9, 2026•
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a1e989b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Mar 9, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b

@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed the chore/hono-lockfile-refresh branch from 5c7fbed to 113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger changed the title chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger marked this pull request as ready for review March 9, 2026 18:00
@felixweinberger
felixweinberger requested a review from a team as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger changed the title chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot reviewed Mar 11, 2026
View reviewed changes

@claudeclaudeBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.

Extended reasoning...

Overview

This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):

  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible

Security risks

None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).

Level of scrutiny

Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.

Other factors

Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.

@felixweinberger
felixweinberger enabled auto-merge (squash) March 12, 2026 14:59
claude[bot]
claudeBot reviewed Mar 12, 2026
View reviewed changes

@claudeclaudeBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.

Extended reasoning...

Overview

This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:

  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible

No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.

Security risks

None introduced; this PR is net-positive on security:

  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers

The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.

Level of scrutiny

Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.

Other factors

  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid

@felixweinberger
felixweinberger merged commit 5405172 into mainMar 13, 2026
17 checks passed
@felixweinberger
felixweinberger deleted the chore/hono-lockfile-refresh branch March 13, 2026 14:49
pcarleton added a commit to sagar-okta/typescript-sdk that referenced this pull request Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot reviewed Mar 13, 2026
View reviewed changes

@claudeclaudeBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.

Extended reasoning...

Overview

This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.

Security risks

None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.

Level of scrutiny

Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.

Other factors

No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x - #1650
Merged
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Mar 13, 2026
Merged
chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.x#1650
felixweinberger merged 6 commits into
mainfrom 
chore/hono-lockfile-refresh
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps conformance 0.1.10 → 0.1.15. Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing Dependabot alert #44 (GHSA-345p-7cg4-v4c7).
Forward-ports #1545 from v1.x so auth/pre-registration passes (adapter-only, no SDK changes). Adds expected-failures.yaml baseline for cross-app-access-complete-flow (SEP-990, blocked on #1531).
Also drops stale minimumReleaseAgeExclude entries.
@changeset-bot
changeset-botBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: a1e989b
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1650

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1650

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1650

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1650

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1650

commit: a1e989b
@felixweinberger
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15
113caa2
Pulls sdk@^1.26.0 (resolves to 1.27.1), clearing the Dependabot alert
for GHSA-345p-7cg4-v4c7 (cross-client data leak, fixed in 1.26.0).
Also removes stale minimumReleaseAgeExclude entries for
hono@4.11.4 and @hono/node-server@1.19.9 (both well past 7 days).
@felixweinberger
felixweinbergerforce-pushed
the
chore/hono-lockfile-refresh
branch
from
5c7fbed to
113caa2CompareMarch 9, 2026 17:48
@felixweinbergerfelixweinberger
changed the title
chore: bump hono + @hono/node-server in lockfilechore(deps): bump @modelcontextprotocol/conformance to 0.1.15Mar 9, 2026
@felixweinberger
test(conformance): add expected-failures baseline for unimplemented s…
54fa771
…cenarios
Conformance 0.1.15 added three scenarios the v2 SDK doesn't implement yet:
- client: auth/pre-registration (OAuth without DCR)
- client: auth/cross-app-access-complete-flow (SEP-990)
- server: dns-rebinding-protection
Baseline them via --expected-failures so CI exits 0 on expected failures,
1 on regressions or stale entries (scenario starts passing → must update file).
@felixweinberger
felixweinberger
marked this pull request as ready for review
March 9, 2026 18:00
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerMarch 9, 2026 18:00
@felixweinberger
test(conformance): enable DNS rebinding protection in everything server
62ff4c2
The SDK has localhostHostValidation() middleware; the conformance test
server just wasn't using it. Add it so the dns-rebinding-protection
scenario passes instead of baselining it as an expected failure.
@felixweinberger
test(conformance): port auth/pre-registration scenario from v1.x
6ff84da
Forward-ports PR #1545 from v1.x. The SDK already skips DCR when
clientInformation() returns pre-populated credentials; only the
conformance adapter wiring was missing.
- withOAuthRetry: accept optional existingProvider
- everythingClient: register auth/pre-registration handler
- expected-failures: drop now-passing scenario
@felixweinbergerfelixweinberger
changed the title
chore(deps): bump @modelcontextprotocol/conformance to 0.1.15chore(deps): bump conformance to 0.1.15, port auth/pre-registration from v1.xMar 11, 2026
claude[bot]
claudeBot
reviewed
Mar 11, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-harness dependency bump with corresponding fixture updates, no production code touched.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15 and makes the test harness changes needed to pass the new conformance suite version. All code changes are confined to test/conformance/ (a private test-only package):
  • pnpm-lock.yaml / package.json — the version bump itself, pulling sdk@1.27.1 transitively (clears a Dependabot alert for express-rate-limit)
  • pnpm-workspace.yaml — drops stale minimumReleaseAgeExclude entries for hono/@hono/node-server now that the fix versions are past the 7-day window
  • expected-failures.yaml — new baseline listing auth/cross-app-access-complete-flow as not-yet-implemented, wired into the test scripts via --expected-failures
  • everythingClient.ts — adds the auth/pre-registration scenario, following the same pattern as existing auth scenarios; uses a pre-populated ConformanceOAuthProvider to skip dynamic client registration
  • everythingServer.ts — enables localhostHostValidation() middleware so the DNS-rebinding-protection scenario passes
  • withOAuthRetry.ts — adds an optional existingProvider parameter with ?? fallback, fully backwards-compatible
Security risks
None. No production or published code is modified. The lockfile changes are transitive deps of a dev-only test package. The localhostHostValidation() addition improves the security posture of the test server (though it's only ever bound to localhost anyway).
Level of scrutiny
Low. This is test infrastructure maintenance — a dependency bump with the minimal fixture changes needed to keep CI green on the new suite version. No package exports, no API changes, no logic in shipped code. The shell script at scripts/run-server-conformance.sh already forwards "$@", so the new --expected-failures flag is correctly plumbed through.
Other factors
Verified that localhostHostValidation is exported from @modelcontextprotocol/express (packages/middleware/express/src/middleware/hostHeaderValidation.ts:50) and that ConformanceOAuthProvider.saveClientInformation exists (test/conformance/src/helpers/conformanceOAuthProvider.ts:38). The PR description mentions three new scenarios but only one is in expected-failures.yaml — this is consistent, since the other two (pre-registration and dns-rebinding) are implemented by this PR rather than marked as expected failures. No changeset is needed since @modelcontextprotocol/test-conformance is private.
@felixweinberger
felixweinberger
enabled auto-merge (squash)
March 12, 2026 14:59
claude[bot]
claudeBot
reviewed
Mar 12, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-infrastructure-only dep bump and conformance scenario port, no SDK changes.
Extended reasoning...
Overview
This PR bumps the conformance test tool from 0.1.10 to 0.1.15 and forward-ports the auth/pre-registration scenario from v1.x (#1545). All changes are confined to test infrastructure:
  • pnpm-lock.yaml / pnpm-workspace.yaml: lockfile refresh, removal of stale minimumReleaseAgeExclude entries for hono packages that are now past the 7-day age window
  • test/conformance/expected-failures.yaml: new baseline listing auth/cross-app-access-complete-flow as a known-failing scenario (blocked on #1531)
  • test/conformance/package.json: dep bump and --expected-failures flag wiring into test scripts
  • test/conformance/src/everythingClient.ts: adds a new scenario handler following the exact pattern of runClientCredentialsBasic — parses context, pre-populates the OAuth provider via saveClientInformation, runs connect/listTools/callTool
  • test/conformance/src/everythingServer.ts: adds localhostHostValidation() middleware (DNS rebinding protection) — already landed in 62ff4c2, appears here as merge artifact
  • test/conformance/src/helpers/withOAuthRetry.ts: adds optional existingProvider parameter with ?? fallback to the existing constructor call — fully backward-compatible
No changes to any published SDK package under packages/. The changeset bot correctly notes no changeset needed.
Security risks
None introduced; this PR is net-positive on security:
  • Clears Dependabot alert #44 (GHSA-345p-7cg4-v4c7) by pulling sdk@1.27.1 as a transitive dev-dependency of the conformance tool
  • Adds DNS rebinding protection to the test server (already merged separately)
  • New @octokit/* and undici@7.22.0 deps are transitive dev-dependencies of the conformance CLI only, never shipped to consumers
The auth/pre-registration scenario code is test-adapter code that pre-populates client credentials into a mock OAuth provider — it exercises SDK paths but contains no auth logic itself.
Level of scrutiny
Low. This is a test/** + workspace-config change with zero impact on published packages. The new scenario handler is a near-verbatim copy of existing handlers (runClientCredentialsBasic) with the one difference that it pre-populates client info instead of letting the SDK dynamically register. The run-server-conformance.sh script already uses "$@" pass-through, so the new --expected-failures flag plumbs through correctly.
Other factors
  • No bugs flagged by the bug hunting system
  • No outstanding reviewer comments
  • CODEOWNERS: the auth-team-owned paths (/src/server/auth/, /src/client/auth*, etc.) are not touched — test/conformance/ falls under the default team
  • ConformanceOAuthProvider.saveClientInformation is an existing method at conformanceOAuthProvider.ts:38, so the new callsite is valid
@felixweinberger
felixweinberger
merged commit 5405172
into
mainMar 13, 2026

17 checks passed

@felixweinberger
felixweinberger
deleted the

chore/hono-lockfile-refresh

branch
March 13, 2026 14:49
pcarleton added a commit
to sagar-okta/typescript-sdk
that referenced
this pull request
Mar 13, 2026
@pcarleton
Merge origin/main into feature/sep-990
102bbef
Conflicts:
test/conformance/src/everythingClient.ts
- kept both pre-registration (from modelcontextprotocol#1650) and cross-app-access
discriminated union variants
Also: drop unused OAuthClientInformation import from crossAppAccess.ts
(lint failure from ef35f0b).
claude[bot]
claudeBot
reviewed
Mar 13, 2026
View reviewed changes
@claudeclaudeBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — test-only conformance harness updates with a transitive dep bump that clears a security advisory.
Extended reasoning...
Overview
This PR bumps the @modelcontextprotocol/conformance dev dependency from 0.1.10 to 0.1.15, which transitively pulls sdk@1.27.1 and clears Dependabot alert GHSA-345p-7cg4-v4c7. All non-lockfile changes are confined to test/conformance/ (test harness code, not shipped) plus a two-line cleanup of stale minimumReleaseAgeExclude entries in pnpm-workspace.yaml. The new auth/pre-registration scenario in everythingClient.ts follows the established pattern of other scenarios in the file, and the withOAuthRetry helper gets a backwards-compatible optional existingProvider param. The server gains localhostHostValidation() middleware (DNS rebinding protection), which is a defensive addition for a test-only server.
Security risks
None introduced; the PR is net-positive security-wise. It resolves a known advisory in the transitive v1 SDK dep and adds Host-header validation to the conformance test server. No production SDK code paths are touched. The new transitive deps (@octokit/*, undici@7.22, ip-address, etc.) are all well-known packages pulled in by the conformance runner, not by the published packages.
Level of scrutiny
Low. This is test-infrastructure and workspace-config hygiene. The conformance harness is private: true and not published. The script changes (adding --expected-failures ./expected-failures.yaml) are mechanical and the shell script correctly forwards args via "$@". The minimumReleaseAgeExclude removals are safe because those pinned versions (hono@4.11.4, @hono/node-server@1.19.9) are now well past the 7-day age threshold.
Other factors
No changeset is needed since no published package is affected (changeset-bot correctly notes this). No outstanding reviewer comments. The saveClientInformation method and localhostHostValidation export both exist in the current codebase. The run-server-conformance.sh script passes through --expected-failures via "$@" at line 43.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@pcarletonpcarletonpcarleton approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@pcarleton