Skip to content

deps(mcp): bump the npm-minor group across 1 directory with 4 updates - #892

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/mcp/npm-minor-7669244fee
Open

deps(mcp): bump the npm-minor group across 1 directory with 4 updates#892
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/mcp/npm-minor-7669244fee

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm-minor group with 3 updates in the /apps/mcp directory: agents, @cloudflare/vitest-pool-workers and @cloudflare/workers-types.

Updates agents from 0.17.3 to 0.19.0

Release notes

Sourced from agents's releases.

agents@0.19.0

Minor Changes

  • #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

    The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when bumping these packages.

    Only the current implementations are covered. New optimisations and APIs made available by AI SDK v7 (broader result-shape audits, stream helper migrations, etc.) are intentionally out of scope.

    How dual-version support works — @cloudflare/think calls the AI SDK through the option names present in both majors (v7 keeps the v6 names as aliases), and normalizes the genuine divergences at the boundary:

    • Uses stepCountIs, system, experimental_telemetry, onStepFinish, and experimental_onToolCallFinish (in v7 this alias resolves to onToolExecutionEnd and fires once).

    • The tool-execution-finished event is normalized across majors: v6's { success, output, error, durationMs, stepNumber } and v7's { toolOutput, toolExecutionMs } collapse to one ToolCallResultContext. stepNumber is undefined under v7 (the v7 event no longer provides it).

    • The UI message stream is built via the result's toUIMessageStream() method (present in both majors); the standalone toUIMessageStream({ stream }) helper and result.stream are v7-only.

    • The workspace read tool emits { type: "file-data", data, mediaType, filename } model output, accepted by both majors (v7's newer { type: "file", data: { type: "data", data } } shape does not exist in v6).

      Public API notes:

    • @cloudflare/think keeps system, onStepFinish, and experimental_telemetry where callers already use them, and also accepts TurnConfig.telemetry (forwarded ahead of experimental_telemetry when present).

    • @cloudflare/ai-chat updates the AIChatAgent.onChatMessage callback type from StreamTextOnFinishCallback to GenerateTextOnFinishCallback.

      Verified against both ai@6 and ai@7: @cloudflare/think type-checks with zero errors and its full workers test suite passes under each major.

      Known limitations:

    • workers-ai-provider (Think's default model provider) is fixed at v4 for AI

... (truncated)

Changelog

Sourced from agents's changelog.

0.19.0

Minor Changes

  • #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

    The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when bumping these packages.

    Only the current implementations are covered. New optimisations and APIs made available by AI SDK v7 (broader result-shape audits, stream helper migrations, etc.) are intentionally out of scope.

    How dual-version support works — @cloudflare/think calls the AI SDK through the option names present in both majors (v7 keeps the v6 names as aliases), and normalizes the genuine divergences at the boundary:

    • Uses stepCountIs, system, experimental_telemetry, onStepFinish, and experimental_onToolCallFinish (in v7 this alias resolves to onToolExecutionEnd and fires once).
    • The tool-execution-finished event is normalized across majors: v6's { success, output, error, durationMs, stepNumber } and v7's { toolOutput, toolExecutionMs } collapse to one ToolCallResultContext. stepNumber is undefined under v7 (the v7 event no longer provides it).
    • The UI message stream is built via the result's toUIMessageStream() method (present in both majors); the standalone toUIMessageStream({ stream }) helper and result.stream are v7-only.
    • The workspace read tool emits { type: "file-data", data, mediaType, filename } model output, accepted by both majors (v7's newer { type: "file", data: { type: "data", data } } shape does not exist in v6).

    Public API notes:

    • @cloudflare/think keeps system, onStepFinish, and experimental_telemetry where callers already use them, and also accepts TurnConfig.telemetry (forwarded ahead of experimental_telemetry when present).
    • @cloudflare/ai-chat updates the AIChatAgent.onChatMessage callback type from StreamTextOnFinishCallback to GenerateTextOnFinishCallback.

    Verified against both ai@6 and ai@7: @cloudflare/think type-checks with zero errors and its full workers test suite passes under each major.

    Known limitations:

    • workers-ai-provider (Think's default model provider) is fixed at v4 for AI SDK v7. Consumers on ai@6 who rely on Think's built-in default model may hit a provider-version mismatch; passing their own LanguageModel avoids this.
    • chat@4.31.0 currently declares an ai@^6 peer and does not yet advertise

... (truncated)

Commits

Updates @cloudflare/vitest-pool-workers from 0.18.4 to 0.18.8

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.18.8

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.7

Patch Changes

  • #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@4.20260721.0
    • wrangler@4.113.0

@​cloudflare/vitest-pool-workers@​0.18.6

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.5

Patch Changes

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.18.8

Patch Changes

0.18.7

Patch Changes

  • #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@4.20260721.0
    • wrangler@4.113.0

0.18.6

Patch Changes

0.18.5

Patch Changes

... (truncated)

Commits
  • 16b3d5a Version Packages (#14799)
  • 7b3fea6 fix(vitest-pool-workers): tolerate dispose rejections in pool worker stop() (...
  • 88f42e7 Version Packages (#14740)
  • 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
  • 538e867 [vitest-pool-workers] Treat webSocket* as optional Durable Object handlers ...
  • de34449 [vitest-pool-workers] Fix module fallback failure on non-ASCII workspace path...
  • 5eac99e [vitest-pool-workers] Support streaming tails to the main worker (#14739)
  • 82918ad Version Packages (#14699)
  • 4e62bba fix(vitest-pool-workers): avoid hanging on broken DO logs (#14678)
  • b449bb0 Version Packages (#14644)
  • See full diff in compare view

Updates @cloudflare/workers-types from 5.20260713.1 to 5.20260727.1

Commits

Updates wrangler from 4.110.0 to 4.114.0

Release notes

Sourced from wrangler's releases.

wrangler@4.114.0

Minor Changes

  • #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

    When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

  • #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260721.1 ^5.20260722.1
    workerd 1.20260721.1 1.20260722.1

  • #14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

    The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

  • #14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

    Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

  • #14593 02232f3 Thanks @​spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

    During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

  • #14797 f8a8c2c Thanks @​roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

    Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

  • Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

    • miniflare@4.20260722.0

wrangler@4.113.0

Minor Changes

... (truncated)

Commits
  • 16b3d5a Version Packages (#14799)
  • 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
  • 246ce92 [wrangler] Improve d1 create database-limit error message (#14373)
  • 02232f3 [wrangler] compare origins, not hrefs, when classifying dev proxy fetch error...
  • 8416b33 [wrangler] Fix grammar in container image-too-large error (#14788)
  • f8a8c2c [wrangler] Explain missing Flagship app ID (#14797)
  • 88f42e7 Version Packages (#14740)
  • 9e61971 unskip agent memory remote bindings test (#14786)
  • 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
  • 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: mcp. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 20, 2026 07:15
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 mkit-mcp 60e5938 Jul 27 2026, 07:15 AM

@heavygweit heavygweit added this to the mkit public release (v0.4.0) milestone Jul 21, 2026 — with Claude
@heavygweit heavygweit added the enhancement New feature or request label Jul 21, 2026 — with Claude
@dependabot
deps(mcp): bump the npm-minor group across 1 directory with 4 updates
60e5938 
Bumps the npm-minor group with 3 updates in the /apps/mcp directory: [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [@cloudflare/workers-types](https://github.com/cloudflare/workerd).


Updates `agents` from 0.17.3 to 0.19.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.19.0/packages/agents)

Updates `@cloudflare/vitest-pool-workers` from 0.18.4 to 0.18.8
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.8/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 5.20260713.1 to 5.20260727.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.110.0 to 4.114.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.18.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260719.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: agents
  dependency-version: 0.17.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: wrangler
  dependency-version: 4.112.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps(mcp): bump the npm-minor group in /apps/mcp with 4 updates deps(mcp): bump the npm-minor group across 1 directory with 4 updates Jul 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/apps/mcp/npm-minor-7669244fee branch from 28882da to 60e5938 Compare July 27, 2026 07:14
@christopherwxyz christopherwxyz mentioned this pull request Jul 31, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@dependabot dependabot[bot]

Labels

dependencies Pull requests that update a dependency file enhancement New feature or request

Projects

None yet

Milestone

mkit public release (v0.4.0)

Development

Successfully merging this pull request may close these issues.

1 participant

@heavygweit