[the-laughing-monkey]

Contribution track

• Maintainer-authored repository work

What changed

Update shipped MCP SDK resolutions to 1.32.0, including the runtime installation
projection and lockfiles. Current product HTTP transports are outbound MCP
clients; contributor MCP servers use stdio and do not use experimental taskStore.
No HTTP-server limit is added to client code.

Debian has now published the supported Brotli security backport for both AMD64
and ARM64. Replace the earlier conditional-exception proposal with a required
libbrotli1 >= 1.1.0-2+deb13u1 build floor. The existing authenticated apt update
and upgrade install the patch, and the existing floor check rejects an old mirror
or cached package layer. No new vulnerability exceptions or evaluator changes
remain in the final patch.

Rebased onto current main, preserving its Surplus changes and updating the
changelog without discarding either change.

Validation

• Eight focused security-refresh and native package-floor tests passed with
  573 assertions, including vulnerable/fixed/newer Brotli versions on each
  supported architecture.
• Runtime installation projection check and diff checks passed.
• Required and applicable PR CI must pass on the final head before merge.
• Fresh native image qualification, signed publication and live deployment are
  separate subsequent checks; this PR alone does not establish those results.

Sources

• MCP task-session advisory
• MCP HTTP validation advisory
• Debian Brotli security update

Author checks

• I understand and can explain the changes, including AI-assisted work.
• No credentials, private conversations, personal infrastructure or internal planning identifiers are included.
• Runtime publication, instance adoption and ordinary-user acceptance remain separate from this source change.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​modelcontextprotocol/​sdk@​1.31.0 ⏵ 1.32.0	+1	+24

View full report

[github-actions]

Socket Security: Dependency Overview

Review the following changes in direct dependencies. Learn more about socket.dev

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@rive-app/react-webgl2@4.34.3
	@modelcontextprotocol/sdk@1.32.0
	bun-types@1.4.4
	fastify@5.12.5
	sharp@0.35.5
	smol-toml@1.9.1
	electron@43.8.3