Bump the minor-and-patch group across 1 directory with 19 updates by dependabot[bot] · Pull Request #116 · asyncup-dev/asyncup

dependabot · 2026-11-05T14:56:43Z

Bumps the minor-and-patch group with 19 updates in the / directory:

Package	From	To
@googleapis/chat	`51.2.0`	`51.4.0`
@modelcontextprotocol/node	`2.1.1`	`2.1.2`
@modelcontextprotocol/server	`2.3.1`	`2.4.0`
@node-saml/node-saml	`5.1.0`	`5.2.0`
express-rate-limit	`8.7.1`	`8.7.2`
google-auth-library	`11.2.0`	`11.3.2`
@modelcontextprotocol/client	`2.3.1`	`2.4.0`
@types/bun	`1.4.3`	`1.4.4`
@types/node	`26.6.5`	`26.6.6`
@tanstack/react-query	`5.104.2`	`5.105.2`
@tanstack/react-router	`1.170.42`	`1.170.46`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
@testing-library/user-event	`14.6.7`	`14.6.8`
@vitejs/plugin-react	`6.1.2`	`6.2.1`
@vitest/coverage-v8	`5.0.4`	`5.0.5`
jsdom	`30.1.2`	`30.1.3`
vite	`8.3.4`	`8.3.5`
vitest	`5.0.4`	`5.0.5`

Updates @googleapis/chat from 51.2.0 to 51.4.0

Release notes

Sourced from @googleapis/chat's releases.

chat: v51.4.0

51.4.0 (2026-10-29)

Features

chat: update the API (5414f07)

chat: v51.3.0

51.3.0 (2026-10-22)

Features

chat: update the API (519f65f)

Commits

e4a2e79 chore: release main (#4059)
b0bca20 feat: regenerate index files
fde5d01 feat(workstations): update the API
9d2706c feat(vmwareengine): update the API
5b8c49c feat(vision): update the API
b10722f feat(vault): update the API
346ece0 fix(travelimpactmodel): update the API
5eef8d8 feat(threatintelligence): update the API
e5530cc feat(tasks): update the API
149992c feat(sts): update the API
Additional commits viewable in compare view

Updates @modelcontextprotocol/node from 2.1.1 to 2.1.2

Release notes

Sourced from @modelcontextprotocol/node's releases.

@modelcontextprotocol/node@2.1.2

Patch Changes

#3084 10c26b0 Thanks @claude! - The @hono/node-server dependency range widens from ^1.19.9 to ^1.19.9 || ^2.1.3, so a new install resolves to 2.x and an install that cannot get 2.x keeps 1.x.

Updated dependencies [ef38c67, c05225a, 43c45f4, 5820f79, c05225a, b381559, 46d9c99, 895007f, b022522]:

@modelcontextprotocol/server@2.4.0

Commits

951fe56 Version Packages (#2959)
895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
28124db fix(docs): use relative POSIX package entry globs (#3016)
f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
10c26b0 chore(node): accept @hono/node-server 1.x or 2.x (#3084)
ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.3.1 to 2.4.0

Release notes

Sourced from @modelcontextprotocol/server's releases.

@modelcontextprotocol/server-legacy@2.4.0

Patch Changes

Updated dependencies [46d9c99]:

@modelcontextprotocol/core@2.4.0

@modelcontextprotocol/server@2.4.0

Minor Changes

#3057 c05225a Thanks @steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

#3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

@modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.

@modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).

@modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().

@modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

#3083 ef38c67 Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

#2960 43c45f4 Thanks @claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.

#3081 5820f79 Thanks @claude! - A tool outputSchema whose root is a $ref to a type: "object" entry of its own $defs or definitions (what zod writes for z.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema and structuredContent are no longer wrapped in { result: ... }, so a 2025-era client that read structuredContent.result for such a tool now reads structuredContent. On every era the advertised schema gains type: "object" at its root.

#3057 c05225a Thanks @steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.

#3005 b381559 Thanks @chaeyn! - Reflect resource and resource template update({ title }) changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.

#3002 895007f Thanks @Hugo-DDT! - createMcpHandler now sends Allow: POST on every 405 it answers to a non-POST request, with legacy: 'stateless' (the default) and with legacy: 'reject'.

#2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

Updated dependencies [46d9c99]:

@modelcontextprotocol/core@2.4.0

Commits

951fe56 Version Packages (#2959)
895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
28124db fix(docs): use relative POSIX package entry globs (#3016)
f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
10c26b0 chore(node): accept @hono/node-server 1.x or 2.x (#3084)
ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
Additional commits viewable in compare view

Updates @node-saml/node-saml from 5.1.0 to 5.2.0

Release notes

Sourced from @node-saml/node-saml's releases.

v5.2.0

Check idpIssuer on a login Response and its assertion, and reject a message with more than one Issuer (#515) (71b30b2)

Warn before v6 rejects legacy decryption algorithms (#513) (521e9c8)

Update dependencies without raising the Node floor (#510) (3eb12e0)

Reject replayed assertions by remembering their IDs when asked to, and stop skipping a maxAssertionAgeMs deadline at the epoch (#506) (8ee2835)

Export from the root every type its API uses, and document lib/ as internal (#461) (a0a0123)

Warn when a response lacks a bearer confirmation, or a Recipient or Destination that matches (#505) (32f5b9d)

Check a POST-binding LogoutResponse's status and issuer, as the Redirect binding does (#500) (d3eb48a)

Reject a parsed query whose RelayState is not the one in the signed query string (#498) (ad08542)

Deprecate overriding the methods that validate an incoming message (#504) (b3f7f5f)

Give the attribute-value and multiple-reference warnings a migration path (#509) (49833a9)

Accept decryptionPvk as Base64, read Base64 PKCS #1 private keys, and correct the error for a key that can't be read (#447) (a4abbdc)

Retire the request a signed NoPassive response answers (#501) (d195c63)

Read the status of a signed response from the bytes its signature covers (#502) (dcb358a)

Sign the Redirect-binding parameters as they are sent (#496) (15ac505)

Process the Redirect-binding parameters that were verified, and deprecate the parsed-query argument (#494) (f74b332)

Add the sha256-mgf1 signature algorithm (RSASSA-PSS) (#479) (f5b76d0)

Make metadataContactPerson and metadataOrganization follow the metadata schema, and warn about request Extensions that SAML does not allow (#485) (afdb88a)

Add support for AttributeConsumingService in SAML metadata (#396) (8773120)

Warn when generateServiceProviderMetadata signs with an omitted or unrecognized algorithm (#478) (6b38d03)

Warn when a signature is ignored for having more than one reference (#477) (9c9d381)

Remove the tests of deprecation warnings (#482) (68dbb9a)

Group tests and deprecations in the changelog (#475) (ae42526)

Update xml-crypto to 6.3.3 (#476) (345199d)

Add tests for the signature ambiguity rejections, the SHA-1 fallback, and error statuses (#460) (ef8fef1)

Document turning on debug output with NODE_DEBUG=node-saml (#462) (3af74a3)

Remove normalizeNewlines now that xmldom normalizes line endings (#455) (ba5a887)

Export InMemoryCacheProvider from the package root (#454) (6762d23)

Stop unsigned input from retiring a pending request ID (#448) (bb96591)

Warn when an attribute reaches the profile with no usable value (#427) (c9b213d)

Read the verified bytes in validatePostRequestAsync, not the raw ones (#440) (081ba99)

Enforce SubjectConfirmationData NotOnOrAfter in every validateInResponseTo mode (#439) (fd7d8db)

Stop trusting an unsigned Response's InResponseTo (#434) (95e628e)

Deprecate Profile.getSamlResponseXml() (#426) (503b512)

Warn when a security-relevant default was never chosen, and close InResponseTo replay gaps (#425) (5a47bc4)

Warn when a redirect-binding logout message carries no signature (#420) (2616706)

Update xml-crypto to 6.3 and delegate PEM handling to it (#409) (ac1a318)

Docs: audit the README for accuracy and structure (#430) (b10fce3)

Deprecate the unused host argument on the getAuthorize* methods (#421) (9b07731)

Docs: add AGENTS.md and CLAUDE.md (#416) (91efe9a)

Update dependencies and fix the CI matrix (#417) (a78dfa3)

Security: remove debug dependency (#406) (25c434a)

Update to support Node strip-only TypeScript support (#407) (b6fc8b6)

Changelog

Sourced from @node-saml/node-saml's changelog.

5.2.0 (2026-10-26)

🚀 Minor Changes

[security] Reject replayed assertions by remembering their IDs when asked to, and stop skipping a maxAssertionAgeMs deadline at the epoch #506

Export from the root every type its API uses, and document lib/ as internal #461

Accept decryptionPvk as Base64, read Base64 PKCS #1 private keys, and correct the error for a key that can't be read #447

Add the sha256-mgf1 signature algorithm (RSASSA-PSS) #479

Make metadataContactPerson and metadataOrganization follow the metadata schema, and warn about request Extensions that SAML does not allow #485

Add support for AttributeConsumingService in SAML metadata #396

Warn when generateServiceProviderMetadata signs with an omitted or unrecognized algorithm #478

[security] Warn when a signature is ignored for having more than one reference #477

Export InMemoryCacheProvider from the package root #454

Warn when an attribute reaches the profile with no usable value #427

[security] Warn when a security-relevant default was never chosen, and close InResponseTo replay gaps #425

[security] Warn when a redirect-binding logout message carries no signature #420

⚠️ Deprecations

[security] Warn before v6 rejects legacy decryption algorithms #513

[security] Warn when a response lacks a bearer confirmation, or a Recipient or Destination that matches #505

[security] Deprecate overriding the methods that validate an incoming message #504

Give the attribute-value and multiple-reference warnings a migration path #509

[security] Process the Redirect-binding parameters that were verified, and deprecate the parsed-query argument #494

[security] Deprecate Profile.getSamlResponseXml() #426

Deprecate the unused host argument on the getAuthorize* methods #421

🔗 Dependencies

Update dependencies without raising the Node floor #510

Update xml-crypto to 6.3.3 #476

Update dependencies and fix the CI matrix #417

security: remove debug dependency #406

🐛 Bug Fixes

[security] Check idpIssuer on a login Response and its assertion, and reject a message with more than one Issuer #515

[security] Check a POST-binding LogoutResponse's status and issuer, as the Redirect binding does #500

[security] Reject a parsed query whose RelayState is not the one in the signed query string #498

[security] Retire the request a signed NoPassive response answers #501

[security] Read the status of a signed response from the bytes its signature covers #502

Sign the Redirect-binding parameters as they are sent #496

[security] Stop unsigned input from retiring a pending request ID #448

[security] Read the verified bytes in validatePostRequestAsync, not the raw ones #440

[security] Enforce SubjectConfirmationData NotOnOrAfter in every validateInResponseTo mode #439

[security] Stop trusting an unsigned Response's InResponseTo #434

Update xml-crypto to 6.3 and delegate PEM handling to it #409

📚 Documentation

... (truncated)

Commits

3d083fb Release 5.2.0
71b30b2 Check idpIssuer on a login Response and its assertion, and reject a message...
521e9c8 Warn before v6 rejects legacy decryption algorithms (#513)
3eb12e0 Update dependencies without raising the Node floor (#510)
8ee2835 Reject replayed assertions by remembering their IDs when asked to, and stop s...
a0a0123 Export from the root every type its API uses, and document lib/ as internal...
32f5b9d Warn when a response lacks a bearer confirmation, or a Recipient or Destinati...
d3eb48a Check a POST-binding LogoutResponse's status and issuer, as the Redirect bind...
ad08542 Reject a parsed query whose RelayState is not the one in the signed query s...
b3f7f5f Deprecate overriding the methods that validate an incoming message (#504)
Additional commits viewable in compare view

Updates express-rate-limit from 8.7.1 to 8.7.2

Release notes

Sourced from express-rate-limit's releases.

v8.7.2

You can view the changelog here.

Commits

3fa4577 8.7.2
7427a5c v8.7.2 changelog
da5b115 fix: don't un-count requests that complete after the window resets (#707)
28331a7 docs: Restore hyphenated anchor links for error codes (#705)
404bc3a docs: show how to reset the key of an IPv6 client (#704)
e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
991c16d chore(deps): bump ip-address from 10.7.1 to 10.7.3 (#699)
a6ace2a chore(deps-dev): bump the development-dependencies group with 9 updates (#698)
518a0d5 chore(deps): bump ip-address from 10.7.0 to 10.7.1 (#696)
See full diff in compare view

Updates google-auth-library from 11.2.0 to 11.3.2

Release notes

Sourced from google-auth-library's releases.

google-auth-library: v11.3.2

11.3.2 (2026-10-28)

Bug Fixes

core: Log request/response payloads at DEBUG severity (#9754) (bf46818)

google-auth-library: Add credential deprecation and validation warnings (#9720) (569678a)

google-auth-library: v11.3.1

11.3.1 (2026-10-14)

Bug Fixes

core: Remove --fetch-shim and handle Bun fetch natively (#9573) (62559f1)

core: Remove --gaxios-shim and configure Bun Gaxios fetch (#9569) (640bf51)

Changelog

Sourced from google-auth-library's changelog.

11.3.2 (2026-10-28)

Bug Fixes

core: Log request/response payloads at DEBUG severity (#9754) (bf46818)

google-auth-library: Add credential deprecation and validation warnings (#9720) (569678a)

11.3.1 (2026-10-14)

Bug Fixes

core: Remove --fetch-shim and handle Bun fetch natively (#9573) (62559f1)

core: Remove --gaxios-shim and configure Bun Gaxios fetch (#9569) (640bf51)

11.3.0 (2026-10-08)

Features

Update API sources and regenerate (#9554) (8b6837a)

Commits

cb72356 chore: release main (#9716)
71972b8 chore: resolve CI lint errors in google-auth-library and pubsub (#9735)
569678a fix(google-auth-library): add credential deprecation and validation warnings ...
bf46818 fix(core): log request/response payloads at DEBUG severity (#9754)
24507ca chore(deps): upgrade internal core and veneer -api dependency floors (#9622)
72f2e23 chore: release main (#9604)
62559f1 fix(core): remove --fetch-shim and handle Bun fetch natively (#9573)
640bf51 fix(core): remove --gaxios-shim and configure Bun Gaxios fetch (#9569)
fc0db11 test(google-auth-library): remove --crypto-verify-shim and use named curve (#...
09acd33 test(google-auth-library): remove --assert-deep-equal-shim and fix Headers (#...
Additional commits viewable in compare view

Updates @modelcontextprotocol/client from 2.3.1 to 2.4.0

Release notes

Sourced from @modelcontextprotocol/client's releases.

@modelcontextprotocol/client@2.4.0

Minor Changes

#3085 a633756 Thanks @claude! - Add an opt-in for sending scope on refresh-token requests, for authorization servers that reject a refresh without it (Microsoft Entra ID answers AADSTS90009 when the client and the resource are the same app registration, #2718). OAuthClientProvider gains an optional scopeForRefresh(tokens): auth(), and so the transports and withOAuth, sends the string it returns. refreshAuthorization() gains an optional scope. When a scope is sent and the response has none, the sent scope is kept on the returned tokens. Without either option the refresh request and the saved tokens are unchanged.

#3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

@modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.

@modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).

@modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().

@modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

#3083 ef38c67 Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

#2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

Updated dependencies [46d9c99]:

@modelcontextprotocol/core@2.4.0

Commits

951fe56 Version Packages (#2959)
895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
28124db fix(docs): use relative POSIX package entry globs (#3016)
f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
10c26b0 chore(node): accept @hono/node-server 1.x or 2.x (#3084)
ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
Additional commits viewable in compare view

Updates @types/bun from 1.4.3 to 1.4.4

Commits

See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

See full diff in compare view

Updates @tanstack/react-query from 5.104.2 to 5.105.2

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.105.2

Patch Changes

Updated dependencies [1e1caa5, 8d0dc27]:

@tanstack/react-query@5.105.2

@tanstack/query-devtools@5.105.2

@tanstack/react-query-next-experimental@5.105.2

Patch Changes

Updated dependencies [1e1caa5, 8d0dc27]:

@tanstack/react-query@5.105.2

@tanstack/react-query-persist-client@5.105.2

Patch Changes

Updated dependencies [1e1caa5, 8d0dc27]:

@tanstack/react-query@5.105.2

@tanstack/query-persist-client-core@5.105.2

@tanstack/react-query@5.105.2

Patch Changes

#12230 1e1caa5 - Update the observer options before subscribing so revealing an <Activity> tree whose query key changed while hidden no longer fetches the previous key.

#12480 8d0dc27 - Exclude status from the filters accepted by QueryClient.isMutating, useIsMutating, and injectIsMutating. These APIs always count mutations with status: 'pending'.

Updated dependencies [2ee2fd9, 8d0dc27, e69cac6, f2215d2, 86e7957, b6576b3, af0e0ef, 05d9b6a]:

@tanstack/query-core@5.105.2

Changelog

Sourced from @tanstack/react-query's changelog.

5.105.2

Patch Changes

Bumps the minor-and-patch group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@googleapis/chat](https://github.com/googleapis/google-api-nodejs-client) | `51.2.0` | `51.4.0` | | [@modelcontextprotocol/node](https://github.com/modelcontextprotocol/typescript-sdk) | `2.1.1` | `2.1.2` | | [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.3.1` | `2.4.0` | | [@node-saml/node-saml](https://github.com/node-saml/node-saml) | `5.1.0` | `5.2.0` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.1` | `8.7.2` | | [google-auth-library](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/google-auth-library-nodejs) | `11.2.0` | `11.3.2` | | [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) | `2.3.1` | `2.4.0` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.3` | `1.4.4` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.2` | `5.105.2` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.42` | `1.170.46` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.2` | `6.2.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.4` | `5.0.5` | | [jsdom](https://github.com/jsdom/jsdom) | `30.1.2` | `30.1.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.4` | `8.3.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.0.5` | Updates `@googleapis/chat` from 51.2.0 to 51.4.0 - [Release notes](https://github.com/googleapis/google-api-nodejs-client/releases) - [Commits](googleapis/google-api-nodejs-client@chat-v51.2.0...chat-v51.4.0) Updates `@modelcontextprotocol/node` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/node@2.1.1...@modelcontextprotocol/node@2.1.2) Updates `@modelcontextprotocol/server` from 2.3.1 to 2.4.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.1...@modelcontextprotocol/server@2.4.0) Updates `@node-saml/node-saml` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/node-saml/node-saml/releases) - [Changelog](https://github.com/node-saml/node-saml/blob/master/CHANGELOG.md) - [Commits](node-saml/node-saml@v5.1.0...v5.2.0) Updates `express-rate-limit` from 8.7.1 to 8.7.2 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.7.1...v8.7.2) Updates `google-auth-library` from 11.2.0 to 11.3.2 - [Release notes](https://github.com/googleapis/google-cloud-node/releases) - [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/google-auth-library-nodejs/CHANGELOG.md) - [Commits](https://github.com/googleapis/google-cloud-node/commits/google-auth-library-v11.3.2/core/packages/google-auth-library-nodejs) Updates `@modelcontextprotocol/client` from 2.3.1 to 2.4.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.3.1...@modelcontextprotocol/client@2.4.0) Updates `@types/bun` from 1.4.3 to 1.4.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) Updates `@types/node` from 26.6.5 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@tanstack/react-query` from 5.104.2 to 5.105.2 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.105.2/packages/react-query) Updates `@tanstack/react-router` from 1.170.42 to 1.170.46 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.46/packages/react-router) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@testing-library/user-event` from 14.6.7 to 14.6.8 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](testing-library/user-event@v14.6.7...v14.6.8) Updates `@vitejs/plugin-react` from 6.1.2 to 6.2.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react) Updates `@vitest/coverage-v8` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8) Updates `jsdom` from 30.1.2 to 30.1.3 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.1.2...v30.1.3) Updates `vite` from 8.3.4 to 8.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite) Updates `vitest` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: "@googleapis/chat" dependency-version: 51.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@modelcontextprotocol/node" dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@modelcontextprotocol/server" dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@node-saml/node-saml" dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: express-rate-limit dependency-version: 8.7.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google-auth-library dependency-version: 11.3.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@modelcontextprotocol/client" dependency-version: 2.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/bun" dependency-version: 1.4.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.105.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@tanstack/react-router" dependency-version: 1.170.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@testing-library/user-event" dependency-version: 14.6.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@vitejs/plugin-react" dependency-version: 6.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: jsdom dependency-version: 30.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vite dependency-version: 8.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from akumar-99 as a code owner November 5, 2026 14:56

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 5, 2026

Navigation Menu

Repository navigation

Bump the minor-and-patch group across 1 directory with 19 updates - #116

Bump the minor-and-patch group across 1 directory with 19 updates#116
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-2e98fcf624

dependabot Bot commented on behalf of github Nov 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 5, 2026

chat: v51.4.0

51.4.0 (2026-10-29)

Features

chat: v51.3.0

51.3.0 (2026-10-22)

Features

@​modelcontextprotocol/node@​2.1.2

Patch Changes

@​modelcontextprotocol/server-legacy@​2.4.0

Patch Changes

@​modelcontextprotocol/server@​2.4.0

Minor Changes

Patch Changes

v5.2.0

5.2.0 (2026-10-26)

🚀 Minor Changes

⚠️ Deprecations

🔗 Dependencies

🐛 Bug Fixes

📚 Documentation

v8.7.2

google-auth-library: v11.3.2

11.3.2 (2026-10-28)

Bug Fixes

google-auth-library: v11.3.1

11.3.1 (2026-10-14)

Bug Fixes

11.3.2 (2026-10-28)

Bug Fixes

11.3.1 (2026-10-14)

Bug Fixes

11.3.0 (2026-10-08)

Features

@​modelcontextprotocol/client@​2.4.0

Minor Changes

Patch Changes

@​tanstack/react-query-devtools@​5.105.2

Patch Changes

@​tanstack/react-query-next-experimental@​5.105.2

Patch Changes

@​tanstack/react-query-persist-client@​5.105.2

Patch Changes

@​tanstack/react-query@​5.105.2

Patch Changes

5.105.2

Patch Changes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@modelcontextprotocol/node@2`.1.2

`@modelcontextprotocol/server-legacy@2`.4.0

`@modelcontextprotocol/server@2`.4.0

`@modelcontextprotocol/client@2`.4.0

`@tanstack/react-query-devtools@5`.105.2

`@tanstack/react-query-next-experimental@5`.105.2

`@tanstack/react-query-persist-client@5`.105.2

`@tanstack/react-query@5`.105.2