[dependabot]

Bumps the npm-deps group with 2 updates in the /experimental/ext/rooms/ts directory: @panyam/servicekit-client and @modelcontextprotocol/client.
Bumps the npm-deps group with 1 update in the /ext/ui/assets directory: @modelcontextprotocol/client.

Updates @panyam/servicekit-client from 0.2.0 to 0.2.2

Release notes

Sourced from @​panyam/servicekit-client's releases.

v0.2.2

Added

• servicekit/http/webhooks signs and verifies Standard Webhooks v1 deliveries: Sign, Verify (accepts any of several space-separated signatures), TimestampWithinTolerance, GenerateSecret and ValidateSecret for whsec_ secrets. The HMAC key is the decoded secret, as the spec says. It is standard library only, and matches the spec's test vector and the reference Go library. It moved from mcpkit's experimental/ext/events (mcpkit#1578, PR 59).

v0.2.1

Connection metrics. Servers can now see how many WebSocket, SSE and grpcws connections are open, why each one closed (including clients dropped for not reading), and how many frames went each way, without hand-rolling it. The hooks have no metrics dependency, and servicekit/prom exports them to Prometheus (issues 11 and 13, PR 58).

Added

• http.ConnObserver, with ConnInfo and CloseReason. Set it on BaseConn.Observer / BaseSSEConn.Observer, once on WSConnConfig.Observer / SSEConnConfig.Observer, or on grpcws.ConnOptions.Observer. It hears every open, every close with a reason (client_close, server_close, write_timeout, write_error, pong_timeout, read_error, start_failed) and lifetime, and every frame sent or received. A nil observer costs nothing.
• servicekit/prom: ConnMetrics implements ConnObserver for Prometheus, and HTTPMetrics is request middleware labelled by mux route template. The root go.mod now requires prometheus/client_golang v1.24.1, but http/ and middleware/ don't import it, and make check-deps now fails if they do.
• Load tests for WebSocket (100 connections, 500 connect/disconnect cycles with a goroutine-leak check, broadcast, a slow consumer) and SSE (100 connections, hub churn). They skip under -short.
• make exercise: cmd/grpcws-demo -exercise opens 300 grpcws subscribers, 10 of which never read, and checks /metrics against what the driver did. CI runs it. The demo serves /metrics and takes -write-timeout and -close-on-stream-end.

Fixed

• cmd/grpcws-demo: a room sent its join/leave/action events while holding its lock, and its broadcast loop needs that lock to drain them, so many players leaving at once could deadlock it.

Changelog

Sourced from @​panyam/servicekit-client's changelog.

[v0.2.2] - 2026-10-24

Added

• servicekit/http/webhooks signs and verifies Standard Webhooks v1 deliveries: Sign, Verify (accepts any of several space-separated signatures), TimestampWithinTolerance, GenerateSecret and ValidateSecret for whsec_ secrets. The HMAC key is the decoded secret, as the spec says. It is standard library only, and matches the spec's test vector and the reference Go library. It moved from mcpkit's experimental/ext/events (mcpkit#1578, PR 59).

[v0.2.1] - 2026-10-24

Connection metrics. Servers can now see how many WebSocket, SSE and grpcws connections are open, why each one closed (including clients dropped for not reading), and how many frames went each way, without hand-rolling it. The hooks have no metrics dependency, and servicekit/prom exports them to Prometheus (issues 11 and 13, PR 58).

Added

• http.ConnObserver, with ConnInfo and CloseReason. Set it on BaseConn.Observer / BaseSSEConn.Observer, once on WSConnConfig.Observer / SSEConnConfig.Observer, or on grpcws.ConnOptions.Observer. It hears every open, every close with a reason (client_close, server_close, write_timeout, write_error, pong_timeout, read_error, start_failed) and lifetime, and every frame sent or received. A nil observer costs nothing.
• servicekit/prom: ConnMetrics implements ConnObserver for Prometheus, and HTTPMetrics is request middleware labelled by mux route template. The root go.mod now requires prometheus/client_golang v1.24.1, but http/ and middleware/ don't import it, and make check-deps now fails if they do.
• Load tests for WebSocket (100 connections, 500 connect/disconnect cycles with a goroutine-leak check, broadcast, a slow consumer) and SSE (100 connections, hub churn). They skip under -short.
• make exercise: cmd/grpcws-demo -exercise opens 300 grpcws subscribers, 10 of which never read, and checks /metrics against what the driver did. CI runs it. The demo serves /metrics and takes -write-timeout and -close-on-stream-end.

Fixed

• cmd/grpcws-demo: a room sent its join/leave/action events while holding its lock, and its broadcast loop needs that lock to drain them, so many players leaving at once could deadlock it.

Commits

• fd6429a release: v0.2.2
• 3e8b304 release: v0.2.1
• See full diff in compare view

Updates @modelcontextprotocol/client from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.4.0

Minor Changes

• #3085 a633756 Thanks @​claude! - Add an opt-in for sending scope on refresh-token requests, for authorization servers that reject a refresh without it (Microsoft Entra ID answers AADSTS90009 when the client and the resource are the same app registration, #2718). OAuthClientProvider gains an optional scopeForRefresh(tokens): auth(), and so the transports and withOAuth, sends the string it returns. refreshAuthorization() gains an optional scope. When a scope is sent and the response has none, the sent scope is kept on the returned tokens. Without either option the refresh request and the saved tokens are unchanged.

• #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

• #3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

• #2762 b022522 Thanks @​pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @​modelcontextprotocol/core@​2.4.0

Commits

• 951fe56 Version Packages (#2959)
• 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
• 28124db fix(docs): use relative POSIX package entry globs (#3016)
• f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
• a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
• 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
• ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
• 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
• a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
• c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/client from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.4.0

Minor Changes

• #3085 a633756 Thanks @​claude! - Add an opt-in for sending scope on refresh-token requests, for authorization servers that reject a refresh without it (Microsoft Entra ID answers AADSTS90009 when the client and the resource are the same app registration, #2718). OAuthClientProvider gains an optional scopeForRefresh(tokens): auth(), and so the transports and withOAuth, sends the string it returns. refreshAuthorization() gains an optional scope. When a scope is sent and the response has none, the sent scope is kept on the returned tokens. Without either option the refresh request and the saved tokens are unchanged.

• #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

• #3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

• #2762 b022522 Thanks @​pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @​modelcontextprotocol/core@​2.4.0

Commits

• 951fe56 Version Packages (#2959)
• 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
• 28124db fix(docs): use relative POSIX package entry globs (#3016)
• f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
• a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
• 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
• ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
• 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
• a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
• c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions