dependabot[bot] 92fc339964 chore(deps-dev): bump the dev-dependencies group with 10 updates (#3389)
Bumps the dev-dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.30.0` |
`2.31.0` |
|
[@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk)
| `2.3.1` | `2.4.0` |
|
[@modelcontextprotocol/core](https://github.com/modelcontextprotocol/typescript-sdk)
| `2.3.1` | `2.4.0` |
|
[@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk)
| `2.3.1` | `2.4.0` |
|
[@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon)
| `22.0.0` | `22.0.2` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin)
| `8.71.2` | `8.72.0` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)
| `8.71.2` | `8.72.0` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) |
`65.3.11` | `65.4.2` |
| [rollup](https://github.com/rollup/rollup) | `4.64.9` | `4.65.0` |
|
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
| `8.71.2` | `8.72.0` |

Updates `@google/genai` from 2.30.0 to 2.31.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/releases">@​google/genai's
releases</a>.</em></p>
<blockquote>
<h2>v2.31.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.30.0...v2.31.0">2.31.0</a>
(2026-10-22)</h2>
<h3>Features</h3>
<ul>
<li>Add <code>store</code> to <code>GenerateContentConfig</code> (Gemini
Developer API only) and <code>labels</code> to
<code>LiveConnectConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/0b52aa5ffad1016e1106c5d0918eb8d0d9c26702">0b52aa5</a>)</li>
<li>add base_voice to PromptedVoice in GAOS SDK (<a
href="https://github.com/googleapis/js-genai/commit/d62820bb92119c11171cb28ccdd43bb4f6f0734b">d62820b</a>)</li>
<li>Add generation_output_config to GenerateContentConfig (<a
href="https://github.com/googleapis/js-genai/commit/e82a75a8bfe56529ff2651645b19509199360cbc">e82a75a</a>)</li>
<li>Add Live API in-session context updates
(<code>send_context_update</code>) and types across GenAI SDKs. (<a
href="https://github.com/googleapis/js-genai/commit/177ee684ada5d2fd39450e88a9416b301eaa6ff4">177ee68</a>)</li>
<li>include AudioContent, DocumentContent, and VideoContent in
FunctionResultSubContent (<a
href="https://github.com/googleapis/js-genai/commit/aeaed4ed17a2e15f29962d390fb2220712fa3b36">aeaed4e</a>)</li>
<li><strong>sdks:</strong> enable
<code>fixes.openSingleValueEnumsOct2026</code> across all SDKs (<a
href="https://github.com/googleapis/js-genai/commit/0059474f74758a6f2e9930985b749bc6a7277eb9">0059474</a>)</li>
<li>update discovery doc (<a
href="https://github.com/googleapis/js-genai/commit/40d6e98aca99d0a08e9d318da51f5a418c7695da">40d6e98</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>genai:</strong> raise mid-stream SSE errors and dropped
connections consistently across SDKs; add continuation conformance tests
(<a
href="https://github.com/googleapis/js-genai/commit/38f6ebcda2c39edc588f4274f4abdd2d41e31e9c">38f6ebc</a>)</li>
<li><strong>interactions:</strong> sync
InteractionSseEventInteractionStatus enum with InteractionStatus (<a
href="https://github.com/googleapis/js-genai/commit/be6aa9fc5d3425d37c96138a9bdc0e7b81ccc080">be6aa9f</a>)</li>
<li><strong>triggers:</strong> fix agent triggers OpenAPI overlays,
numeric fields, and SDK patches (<a
href="https://github.com/googleapis/js-genai/commit/0e9031d2e355ead32a274860f1ebb2b066aab0cc">0e9031d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@​google/genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.30.0...v2.31.0">2.31.0</a>
(2026-10-22)</h2>
<h3>Features</h3>
<ul>
<li>Add <code>store</code> to <code>GenerateContentConfig</code> (Gemini
Developer API only) and <code>labels</code> to
<code>LiveConnectConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/0b52aa5ffad1016e1106c5d0918eb8d0d9c26702">0b52aa5</a>)</li>
<li>add base_voice to PromptedVoice in GAOS SDK (<a
href="https://github.com/googleapis/js-genai/commit/d62820bb92119c11171cb28ccdd43bb4f6f0734b">d62820b</a>)</li>
<li>Add generation_output_config to GenerateContentConfig (<a
href="https://github.com/googleapis/js-genai/commit/e82a75a8bfe56529ff2651645b19509199360cbc">e82a75a</a>)</li>
<li>Add Live API in-session context updates
(<code>send_context_update</code>) and types across GenAI SDKs. (<a
href="https://github.com/googleapis/js-genai/commit/177ee684ada5d2fd39450e88a9416b301eaa6ff4">177ee68</a>)</li>
<li>include AudioContent, DocumentContent, and VideoContent in
FunctionResultSubContent (<a
href="https://github.com/googleapis/js-genai/commit/aeaed4ed17a2e15f29962d390fb2220712fa3b36">aeaed4e</a>)</li>
<li><strong>sdks:</strong> enable
<code>fixes.openSingleValueEnumsOct2026</code> across all SDKs (<a
href="https://github.com/googleapis/js-genai/commit/0059474f74758a6f2e9930985b749bc6a7277eb9">0059474</a>)</li>
<li>update discovery doc (<a
href="https://github.com/googleapis/js-genai/commit/40d6e98aca99d0a08e9d318da51f5a418c7695da">40d6e98</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>genai:</strong> raise mid-stream SSE errors and dropped
connections consistently across SDKs; add continuation conformance tests
(<a
href="https://github.com/googleapis/js-genai/commit/38f6ebcda2c39edc588f4274f4abdd2d41e31e9c">38f6ebc</a>)</li>
<li><strong>interactions:</strong> sync
InteractionSseEventInteractionStatus enum with InteractionStatus (<a
href="https://github.com/googleapis/js-genai/commit/be6aa9fc5d3425d37c96138a9bdc0e7b81ccc080">be6aa9f</a>)</li>
<li><strong>triggers:</strong> fix agent triggers OpenAPI overlays,
numeric fields, and SDK patches (<a
href="https://github.com/googleapis/js-genai/commit/0e9031d2e355ead32a274860f1ebb2b066aab0cc">0e9031d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/js-genai/commit/1748ce7031d2ab4f71c42e24f02a5a0fa6e43251"><code>1748ce7</code></a>
chore(main): release 2.31.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/2065">#2065</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/0b52aa5ffad1016e1106c5d0918eb8d0d9c26702"><code>0b52aa5</code></a>
feat: Add <code>store</code> to <code>GenerateContentConfig</code>
(Gemini Developer API only) and ...</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/aeaed4ed17a2e15f29962d390fb2220712fa3b36"><code>aeaed4e</code></a>
feat: include AudioContent, DocumentContent, and VideoContent in
FunctionResu...</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/41aaecbcc3eee3c634df7d0078ce736610d98930"><code>41aaecb</code></a>
chore(cli): update Speakeasy OpenAPI generator to v2.950.8</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/38f6ebcda2c39edc588f4274f4abdd2d41e31e9c"><code>38f6ebc</code></a>
fix(genai): raise mid-stream SSE errors and dropped connections
consistently ...</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/ce47243008e1152b72f1564f493c18a299836c35"><code>ce47243</code></a>
docs: Update unenforced JSON Schema keywords on Interactions schema
fields.</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/bc1d9d03e35c21544dc71e776a70a99aa222d7ed"><code>bc1d9d0</code></a>
chore: make bash the valid return type</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/8934c3fe3ebf1cb64f3c14af3b551bd222393dfa"><code>8934c3f</code></a>
chore(cli): update Speakeasy OpenAPI generator to v2.950.5</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/e82a75a8bfe56529ff2651645b19509199360cbc"><code>e82a75a</code></a>
feat: Add generation_output_config to GenerateContentConfig</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/40d6e98aca99d0a08e9d318da51f5a418c7695da"><code>40d6e98</code></a>
feat: update discovery doc</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/js-genai/compare/v2.30.0...v2.31.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@modelcontextprotocol/client` from 2.3.1 to 2.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/client's
releases</a>.</em></p>
<blockquote>
<h2><code>@​modelcontextprotocol/client</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3085">#3085</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a63375661399956a744ff8b34d03d36e3d09e98a"><code>a633756</code></a>
Thanks <a
href="https://github.com/apps/claude"><code>@​claude</code></a>! - Add
an opt-in for sending <code>scope</code> on refresh-token requests, for
authorization servers that reject a refresh without it (Microsoft Entra
ID answers <code>AADSTS90009</code> when the client and the resource are
the same app registration, <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2718">#2718</a>).
<code>OAuthClientProvider</code> gains an optional
<code>scopeForRefresh(tokens)</code>: <code>auth()</code>, and so the
transports and <code>withOAuth</code>, sends the string it returns.
<code>refreshAuthorization()</code> gains an optional
<code>scope</code>. When a scope is sent and the response has none, the
sent scope is kept on the returned tokens. Without either option the
refresh request and the saved tokens are unchanged.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3047">#3047</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>
Thanks <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>,
<a href="https://github.com/tobi-oye"><code>@​tobi-oye</code></a>, <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a>! -
Add the Skills extension (SEP-2640), reachable through new
<code>ext/skills</code> subpaths; package root exports are
unchanged.</p>
<ul>
<li><code>@modelcontextprotocol/server/ext/skills</code>:
<code>SkillsExtension</code> (<code>attach(server)</code> serves
<code>skills/list</code>, <code>skills/get</code>,
<code>resources/directory/read</code> and a <code>skill://{+path}</code>
resource template), <code>SkillsExtension.load(files)</code> returning a
<code>SkillCatalog</code> with <code>entries</code> and
<code>reload()</code>, the <code>SkillFiles</code> storage adapter with
<code>memorySkillFiles</code>, <code>SkillSource</code> for generated
catalogs, <code>skillEntry</code>, and <code>SkillCatalogError</code>.
Invalid skills are skipped with a warning (<code>onWarning</code>), or
fail under <code>strict</code>. A file whose bytes are valid UTF-8 is
served as <code>text</code>, whatever its MIME type; any other file as a
base64 <code>blob</code>.</li>
<li><code>@modelcontextprotocol/server/ext/skills/node</code>:
<code>loadSkills(folder)</code> and
<code>nodeSkillFiles(folder)</code>.</li>
<li><code>@modelcontextprotocol/client/ext/skills</code>:
<code>SkillsClient</code> with <code>list()</code> (throws on an invalid
entry; <code>skipInvalid: true</code> keeps the valid ones and returns
the rest in <code>invalid</code>), <code>get()</code>, <code>read(skill,
path?)</code> (size, digest and <code>SKILL.md</code> frontmatter
verified, <code>SkillVerificationError</code> on a mismatch; a copy from
the response cache that fails a check is fetched once more with
<code>cacheMode: 'refresh'</code> first) and
<code>readDirectory()</code>.</li>
<li><code>@modelcontextprotocol/core/ext/skills</code>: schemas, types
and constants, including <code>SKILL_LIMITS</code>. The result schemas
follow the stable spec, so <code>ttlMs</code> and
<code>cacheScope</code> are required.</li>
</ul>
<p><code>SkillsExtension.attach</code> is <code>@experimental</code>:
how an extension is wired to a server may change in a minor release. The
rest of the Skills API is stable.</p>
<p>Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server
sends the caching fields (<code>ttlMs</code>, <code>cacheScope</code>),
and <code>SkillsClient</code> requires them and returns them from
<code>list()</code>, <code>get()</code> and
<code>readDirectory()</code>.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3083">#3083</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a>
Thanks <a
href="https://github.com/apps/claude"><code>@​claude</code></a>! - The
bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0).
fast-uri 3.1.6 and later reject a <code>$id</code> or <code>$ref</code>
whose text before the first colon is not a valid URI scheme
(<code>my_tool:output</code>), or whose URN namespace is not valid
(<code>urn:my_tool:output</code>): a schema that uses one no longer
compiles, and a tool that carries it fails with an invalid-schema error.
An underscore without a colon (<code>my_tool_output</code>) and a
<code>$ref</code> into <code>#/$defs/...</code> or
<code>#/definitions/...</code> are not affected.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2762">#2762</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b022522089a0c8b632595c6e7b536453945ed5a9"><code>b022522</code></a>
Thanks <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a>! -
<code>x-mcp-header</code> on a <code>number</code>-typed tool parameter
is now rejected, matching the 2026-07-28 spec (&quot;Parameters with
type <code>number</code> are not permitted&quot;; clients MUST exclude
such tools from <code>tools/list</code>). Previously <code>number</code>
was accepted only to satisfy an older conformance fixture that has since
been corrected. <code>integer</code>, <code>string</code> and
<code>boolean</code> are unaffected.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>]:</p>
<ul>
<li><code>@​modelcontextprotocol/core</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/951fe5603a7ec0b2dcb6a0b95d92cd86f93ad9e5"><code>951fe56</code></a>
Version Packages (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2959">#2959</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/895007fe728b9c57fbe3ed45fe279ddc51f731f7"><code>895007f</code></a>
fix(server): set Allow: POST on stateless legacy 405 responses (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3002">#3002</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/28124dbb57594be1ca25e85122066d1e5d4535b5"><code>28124db</code></a>
fix(docs): use relative POSIX package entry globs (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3016">#3016</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/f7289b3531cdd7d8487663ca437496c1dfe0fe05"><code>f7289b3</code></a>
docs: say that a spec handler's params drop members the spec does not
define ...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a63375661399956a744ff8b34d03d36e3d09e98a"><code>a633756</code></a>
feat(client): add an opt-in for sending scope on token refresh (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3085">#3085</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/10c26b00cb9c6d12332a92ea02f75530452450e4"><code>10c26b0</code></a>
chore(node): accept <code>@​hono/node-server</code> 1.x or 2.x (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3084">#3084</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a>
chore(deps): build the bundled ajv with fast-uri 3.1.8 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3083">#3083</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5820f796a48ae6b8e756a7fbfd627e7e2e1ac891"><code>5820f79</code></a>
fix(server): treat an outputSchema root $ref to an object definition as
an ob...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a513cfecff33d6a34469854d331fa0cc84e208d4"><code>a513cfe</code></a>
docs: close the v1 to v2 quick path with the 2026-07-28 serving decision
(<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3086">#3086</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c822443f270fbec2f15d36dcced45bd7e8556f2e"><code>c822443</code></a>
docs(server): mark SkillsExtension.attach as experimental (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3080">#3080</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.3.1...@modelcontextprotocol/client@2.4.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@modelcontextprotocol/core` from 2.3.1 to 2.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​modelcontextprotocol/core</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3047">#3047</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>
Thanks <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>,
<a href="https://github.com/tobi-oye"><code>@​tobi-oye</code></a>, <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a>! -
Add the Skills extension (SEP-2640), reachable through new
<code>ext/skills</code> subpaths; package root exports are
unchanged.</p>
<ul>
<li><code>@modelcontextprotocol/server/ext/skills</code>:
<code>SkillsExtension</code> (<code>attach(server)</code> serves
<code>skills/list</code>, <code>skills/get</code>,
<code>resources/directory/read</code> and a <code>skill://{+path}</code>
resource template), <code>SkillsExtension.load(files)</code> returning a
<code>SkillCatalog</code> with <code>entries</code> and
<code>reload()</code>, the <code>SkillFiles</code> storage adapter with
<code>memorySkillFiles</code>, <code>SkillSource</code> for generated
catalogs, <code>skillEntry</code>, and <code>SkillCatalogError</code>.
Invalid skills are skipped with a warning (<code>onWarning</code>), or
fail under <code>strict</code>. A file whose bytes are valid UTF-8 is
served as <code>text</code>, whatever its MIME type; any other file as a
base64 <code>blob</code>.</li>
<li><code>@modelcontextprotocol/server/ext/skills/node</code>:
<code>loadSkills(folder)</code> and
<code>nodeSkillFiles(folder)</code>.</li>
<li><code>@modelcontextprotocol/client/ext/skills</code>:
<code>SkillsClient</code> with <code>list()</code> (throws on an invalid
entry; <code>skipInvalid: true</code> keeps the valid ones and returns
the rest in <code>invalid</code>), <code>get()</code>, <code>read(skill,
path?)</code> (size, digest and <code>SKILL.md</code> frontmatter
verified, <code>SkillVerificationError</code> on a mismatch; a copy from
the response cache that fails a check is fetched once more with
<code>cacheMode: 'refresh'</code> first) and
<code>readDirectory()</code>.</li>
<li><code>@modelcontextprotocol/core/ext/skills</code>: schemas, types
and constants, including <code>SKILL_LIMITS</code>. The result schemas
follow the stable spec, so <code>ttlMs</code> and
<code>cacheScope</code> are required.</li>
</ul>
<p><code>SkillsExtension.attach</code> is <code>@experimental</code>:
how an extension is wired to a server may change in a minor release. The
rest of the Skills API is stable.</p>
<p>Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server
sends the caching fields (<code>ttlMs</code>, <code>cacheScope</code>),
and <code>SkillsClient</code> requires them and returns them from
<code>list()</code>, <code>get()</code> and
<code>readDirectory()</code>.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/951fe5603a7ec0b2dcb6a0b95d92cd86f93ad9e5"><code>951fe56</code></a>
Version Packages (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2959">#2959</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/895007fe728b9c57fbe3ed45fe279ddc51f731f7"><code>895007f</code></a>
fix(server): set Allow: POST on stateless legacy 405 responses (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3002">#3002</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/28124dbb57594be1ca25e85122066d1e5d4535b5"><code>28124db</code></a>
fix(docs): use relative POSIX package entry globs (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3016">#3016</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/f7289b3531cdd7d8487663ca437496c1dfe0fe05"><code>f7289b3</code></a>
docs: say that a spec handler's params drop members the spec does not
define ...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a63375661399956a744ff8b34d03d36e3d09e98a"><code>a633756</code></a>
feat(client): add an opt-in for sending scope on token refresh (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3085">#3085</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/10c26b00cb9c6d12332a92ea02f75530452450e4"><code>10c26b0</code></a>
chore(node): accept <code>@​hono/node-server</code> 1.x or 2.x (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3084">#3084</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a>
chore(deps): build the bundled ajv with fast-uri 3.1.8 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3083">#3083</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5820f796a48ae6b8e756a7fbfd627e7e2e1ac891"><code>5820f79</code></a>
fix(server): treat an outputSchema root $ref to an object definition as
an ob...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a513cfecff33d6a34469854d331fa0cc84e208d4"><code>a513cfe</code></a>
docs: close the v1 to v2 quick path with the 2026-07-28 serving decision
(<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3086">#3086</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c822443f270fbec2f15d36dcced45bd7e8556f2e"><code>c822443</code></a>
docs(server): mark SkillsExtension.attach as experimental (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3080">#3080</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/core@2.3.1...@modelcontextprotocol/core@2.4.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@modelcontextprotocol/server` from 2.3.1 to 2.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/server's
releases</a>.</em></p>
<blockquote>
<h2><code>@​modelcontextprotocol/server-legacy</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>]:
<ul>
<li><code>@​modelcontextprotocol/core</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</li>
</ul>
</li>
</ul>
<h2><code>@​modelcontextprotocol/server</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3057">#3057</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c05225a636c679870b65f8ca4fe83a76ea1cf113"><code>c05225a</code></a>
Thanks <a
href="https://github.com/steipete"><code>@​steipete</code></a>! -
<code>ServerEvent</code> takes optional <code>params</code>, which the
<code>subscriptions/listen</code> router delivers with its own
subscription ID, so a gateway can forward change notifications with
their <code>_meta</code> and extension params.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3047">#3047</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>
Thanks <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>,
<a href="https://github.com/tobi-oye"><code>@​tobi-oye</code></a>, <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a>! -
Add the Skills extension (SEP-2640), reachable through new
<code>ext/skills</code> subpaths; package root exports are
unchanged.</p>
<ul>
<li><code>@modelcontextprotocol/server/ext/skills</code>:
<code>SkillsExtension</code> (<code>attach(server)</code> serves
<code>skills/list</code>, <code>skills/get</code>,
<code>resources/directory/read</code> and a <code>skill://{+path}</code>
resource template), <code>SkillsExtension.load(files)</code> returning a
<code>SkillCatalog</code> with <code>entries</code> and
<code>reload()</code>, the <code>SkillFiles</code> storage adapter with
<code>memorySkillFiles</code>, <code>SkillSource</code> for generated
catalogs, <code>skillEntry</code>, and <code>SkillCatalogError</code>.
Invalid skills are skipped with a warning (<code>onWarning</code>), or
fail under <code>strict</code>. A file whose bytes are valid UTF-8 is
served as <code>text</code>, whatever its MIME type; any other file as a
base64 <code>blob</code>.</li>
<li><code>@modelcontextprotocol/server/ext/skills/node</code>:
<code>loadSkills(folder)</code> and
<code>nodeSkillFiles(folder)</code>.</li>
<li><code>@modelcontextprotocol/client/ext/skills</code>:
<code>SkillsClient</code> with <code>list()</code> (throws on an invalid
entry; <code>skipInvalid: true</code> keeps the valid ones and returns
the rest in <code>invalid</code>), <code>get()</code>, <code>read(skill,
path?)</code> (size, digest and <code>SKILL.md</code> frontmatter
verified, <code>SkillVerificationError</code> on a mismatch; a copy from
the response cache that fails a check is fetched once more with
<code>cacheMode: 'refresh'</code> first) and
<code>readDirectory()</code>.</li>
<li><code>@modelcontextprotocol/core/ext/skills</code>: schemas, types
and constants, including <code>SKILL_LIMITS</code>. The result schemas
follow the stable spec, so <code>ttlMs</code> and
<code>cacheScope</code> are required.</li>
</ul>
<p><code>SkillsExtension.attach</code> is <code>@experimental</code>:
how an extension is wired to a server may change in a minor release. The
rest of the Skills API is stable.</p>
<p>Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server
sends the caching fields (<code>ttlMs</code>, <code>cacheScope</code>),
and <code>SkillsClient</code> requires them and returns them from
<code>list()</code>, <code>get()</code> and
<code>readDirectory()</code>.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3083">#3083</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a>
Thanks <a
href="https://github.com/apps/claude"><code>@​claude</code></a>! - The
bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0).
fast-uri 3.1.6 and later reject a <code>$id</code> or <code>$ref</code>
whose text before the first colon is not a valid URI scheme
(<code>my_tool:output</code>), or whose URN namespace is not valid
(<code>urn:my_tool:output</code>): a schema that uses one no longer
compiles, and a tool that carries it fails with an invalid-schema error.
An underscore without a colon (<code>my_tool_output</code>) and a
<code>$ref</code> into <code>#/$defs/...</code> or
<code>#/definitions/...</code> are not affected.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2960">#2960</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/43c45f4941d824e7251a7d1266823a84af90fab3"><code>43c45f4</code></a>
Thanks <a
href="https://github.com/apps/claude"><code>@​claude</code></a>! - A
server whose tool puts <code>x-mcp-header</code> on a
<code>number</code>-typed parameter keeps checking that tool's
<code>Mcp-Param-*</code> headers on <code>tools/call</code>, as 2.3.0
does: a header that is missing for a value in the body, or that
disagrees with the body, is answered <code>400</code> with JSON-RPC
error <code>-32020</code>. Clients on a 2026-07-28 connection other than
stdio no longer list such a tool and send no <code>Mcp-Param-*</code>
headers for it, so a call that carries a value for a declared parameter
is rejected the same way; the server logs a warning each time tools are
listed. Use an integer (<code>z.int()</code>) or remove the
annotation.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3081">#3081</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5820f796a48ae6b8e756a7fbfd627e7e2e1ac891"><code>5820f79</code></a>
Thanks <a
href="https://github.com/apps/claude"><code>@​claude</code></a>! - A
tool <code>outputSchema</code> whose root is a <code>$ref</code> to a
<code>type: &quot;object&quot;</code> entry of its own
<code>$defs</code> or <code>definitions</code> (what zod writes for
<code>z.object({...}).meta({ id })</code>), or a union of such refs, is
now treated as an object schema. On 2025-era connections the tool's
schema and <code>structuredContent</code> are no longer wrapped in
<code>{ result: ... }</code>, so a 2025-era client that read
<code>structuredContent.result</code> for such a tool now reads
<code>structuredContent</code>. On every era the advertised schema gains
<code>type: &quot;object&quot;</code> at its root.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3057">#3057</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c05225a636c679870b65f8ca4fe83a76ea1cf113"><code>c05225a</code></a>
Thanks <a
href="https://github.com/steipete"><code>@​steipete</code></a>! -
Connecting a <code>Server</code> or <code>McpServer</code> to a
<code>PerRequestHTTPServerTransport</code> classified at a modern
revision that <code>supportedProtocolVersions</code> lists and the SDK
implements now binds that revision, instead of answering
<code>-32022</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3005">#3005</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b381559edc0dbe25ab8324cada345b49bd1d2fc4"><code>b381559</code></a>
Thanks <a href="https://github.com/chaeyn"><code>@​chaeyn</code></a>! -
Reflect resource and resource template <code>update({ title })</code>
changes in list responses. Preserve other metadata and individual
resource titles when a template supplies list entries.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/3002">#3002</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/895007fe728b9c57fbe3ed45fe279ddc51f731f7"><code>895007f</code></a>
Thanks <a
href="https://github.com/Hugo-DDT"><code>@​Hugo-DDT</code></a>! -
<code>createMcpHandler</code> now sends <code>Allow: POST</code> on
every <code>405</code> it answers to a non-POST request, with
<code>legacy: 'stateless'</code> (the default) and with <code>legacy:
'reject'</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2762">#2762</a>
<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b022522089a0c8b632595c6e7b536453945ed5a9"><code>b022522</code></a>
Thanks <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a>! -
<code>x-mcp-header</code> on a <code>number</code>-typed tool parameter
is now rejected, matching the 2026-07-28 spec (&quot;Parameters with
type <code>number</code> are not permitted&quot;; clients MUST exclude
such tools from <code>tools/list</code>). Previously <code>number</code>
was accepted only to satisfy an older conformance fixture that has since
been corrected. <code>integer</code>, <code>string</code> and
<code>boolean</code> are unaffected.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/46d9c9921b6542e813c1ecc5f9fc964085e8e3bb"><code>46d9c99</code></a>]:</p>
<ul>
<li><code>@​modelcontextprotocol/core</code><a
href="https://github.com/2"><code>@​2</code></a>.4.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/951fe5603a7ec0b2dcb6a0b95d92cd86f93ad9e5"><code>951fe56</code></a>
Version Packages (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2959">#2959</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/895007fe728b9c57fbe3ed45fe279ddc51f731f7"><code>895007f</code></a>
fix(server): set Allow: POST on stateless legacy 405 responses (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3002">#3002</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/28124dbb57594be1ca25e85122066d1e5d4535b5"><code>28124db</code></a>
fix(docs): use relative POSIX package entry globs (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3016">#3016</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/f7289b3531cdd7d8487663ca437496c1dfe0fe05"><code>f7289b3</code></a>
docs: say that a spec handler's params drop members the spec does not
define ...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a63375661399956a744ff8b34d03d36e3d09e98a"><code>a633756</code></a>
feat(client): add an opt-in for sending scope on token refresh (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3085">#3085</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/10c26b00cb9c6d12332a92ea02f75530452450e4"><code>10c26b0</code></a>
chore(node): accept <code>@​hono/node-server</code> 1.x or 2.x (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3084">#3084</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/ef38c6765a15ee29030340dfea28b013893fa0a2"><code>ef38c67</code></a>
chore(deps): build the bundled ajv with fast-uri 3.1.8 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3083">#3083</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/5820f796a48ae6b8e756a7fbfd627e7e2e1ac891"><code>5820f79</code></a>
fix(server): treat an outputSchema root $ref to an object definition as
an ob...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a513cfecff33d6a34469854d331fa0cc84e208d4"><code>a513cfe</code></a>
docs: close the v1 to v2 quick path with the 2026-07-28 serving decision
(<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3086">#3086</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/c822443f270fbec2f15d36dcced45bd7e8556f2e"><code>c822443</code></a>
docs(server): mark SkillsExtension.attach as experimental (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/3080">#3080</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.1...@modelcontextprotocol/server@2.4.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/sinon` from 22.0.0 to 22.0.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon">compare
view</a></li>
</ul>
</details>
<br />

Updates `@typescript-eslint/eslint-plugin` from 8.71.2 to 8.72.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS &lt; 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments &amp; whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy"><code>@​jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz"><code>@​fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS"><code>@​ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md">@​typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992">#12992</a>)</li>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010">#13010</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054">#13054</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS &lt; 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055">#13055</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016">#13016</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments &amp; whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy"><code>@​jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz"><code>@​fitchmultz</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71"><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c6eb98c17cbeee540d3c48d1406098430b2f0660"><code>c6eb98c</code></a>
feat(eslint-plugin): [await-thenable] add
<code>allowMixedPromiseArrays</code> option (#...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b382b74579e5514c247ed54d0dfc428f3a173f3a"><code>b382b74</code></a>
fix(type-utils): discriminateAnyType crashes when calling getAwaitedType
on a...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79edd896790b031457fc0ca6f81c732b29921c9d"><code>79edd89</code></a>
fix(eslint-plugin): [require-array-sort-compare] ignore extra this type
argum...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/e7d57dd6ea0945ae71ba9f68d04270caecda1735"><code>e7d57dd</code></a>
fix(eslint-plugin): [require-array-sort-compare] check tuples (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13058">#13058</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2d107aef73ec9a36a6b4da501ab3fb97dca1d4c0"><code>2d107ae</code></a>
fix(eslint-plugin): use isTypeLiteralType instead of type.isLiteral() to
incl...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/e4695b39dbf2427afe14531095c6221c340ee3f1"><code>e4695b3</code></a>
feat(eslint-plugin): lazy load rules (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13010">#13010</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a1a912bffce02a96f8661806d92202f867f9c6ce"><code>a1a912b</code></a>
fix(eslint-plugin): [no-deprecated] report deprecated properties in
object li...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1edc975742ca23390a4daf3a1d0193feafe92818"><code>1edc975</code></a>
fix(eslint-plugin): [prefer-readonly-parameter-types] check where
allowed typ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/61cb7009708e90add897ca53c58666a19e615606"><code>61cb700</code></a>
chore: fix all
<code>eslint-plugin-internal/no-multiple-lines-of-errors</code> (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12893">#12893</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/eslint-plugin">compare
view</a></li>
</ul>
</details>
<br />

Updates `@typescript-eslint/parser` from 8.71.2 to 8.72.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS &lt; 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments &amp; whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy"><code>@​jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz"><code>@​fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS"><code>@​ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md">@​typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.0 (2026-10-19)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71"><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/parser">compare
view</a></li>
</ul>
</details>
<br />

Updates `eslint-plugin-jsdoc` from 65.3.11 to 65.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gajus/eslint-plugin-jsdoc/releases">eslint-plugin-jsdoc's
releases</a>.</em></p>
<blockquote>
<h2>v65.4.2</h2>
<h2><a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.4.1...v65.4.2">65.4.2</a>
(2026-10-23)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong><code>ts-method-signature-style</code>:</strong> do not turn
optional or readonly function properties into method signatures (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/94952b2457c4dd3833509159b430d0c1524ff2de">94952b2</a>)</li>
<li><strong><code>ts-method-signature-style</code>:</strong> keep
<code>?</code> when converting between function properties and method
signatures (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/a4040aad3670727141f4d2ae2d639e9131ba57fb">a4040aa</a>)</li>
</ul>
<h2>v65.4.1</h2>
<h2><a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.4.0...v65.4.1">65.4.1</a>
(2026-10-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong><code>ts-prefer-function-type</code>:</strong> do not throw
on call signatures inside object fields, parameters or return types, and
keep the type when fixing (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/8830b2ea2f27d9afec6e097c2934a302419e12ae">8830b2e</a>)</li>
</ul>
<h2>v65.4.0</h2>
<h1><a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.16...v65.4.0">65.4.0</a>
(2026-10-20)</h1>
<h3>Features</h3>
<ul>
<li><strong><code>check-tag-names</code>:</strong> move matching <a
href="https://github.com/prop"><code>@​prop</code></a> descriptions onto
properties (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/84eee2cd4a8a75e3b0c0365df114f4a1ff55a410">84eee2c</a>),
closes <a
href="https://redirect.github.com/gajus/eslint-plugin-jsdoc/issues/1054">#1054</a></li>
</ul>
<h2>v65.3.16</h2>
<h2><a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.15...v65.3.16">65.3.16</a>
(2026-10-20)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>handle typed computed properties; fixes <a
href="https://redirect.github.com/gajus/eslint-plugin-jsdoc/issues/1822">#1822</a>
(<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/516263d0837231d26db275ffbc42bfb8875a1622">516263d</a>)</li>
</ul>
<h2>v65.3.15</h2>
<h2><a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.14...v65.3.15">65.3.15</a>
(2026-10-19)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong><code>prefer-import-tag</code>:</strong> only exempt
<code>@typedef</code> itself, not every name-defining tag (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/49018700dea269f39a728bece2319fc8d6c00608">4901870</a>)</li>
<li><strong><code>prefer-import-tag</code>:</strong> only use
<code>@typedef</code> names as aliases for <code>import()</code> types
(<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/df6e2812570939ad8a65fdda6ec4aa83cae2bf07">df6e281</a>)</li>
</ul>
<h2>v65.3.14</h2>
<h2><a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.13...v65.3.14">65.3.14</a>
(2026-10-19)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong><code>check-param-names</code>, <code>require-jsdoc</code>,
<code>convert-to-jsdoc-comments</code>:</strong> do not throw on
<code>settings.jsdoc.contexts</code> entries the rule cannot handle (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/f5ba20ba414a5be73be0f4467fb30b025dbd0cae">f5ba20b</a>)</li>
<li><strong><code>require-jsdoc</code>,
<code>convert-to-jsdoc-comments</code>:</strong> throw a clear error for
a <code>comment</code> in the contexts setting (<a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/ebe5186c1125b27f756cc05176a672a582a5eddc">ebe5186</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/a4040aad3670727141f4d2ae2d639e9131ba57fb"><code>a4040aa</code></a>
fix(<code>ts-method-signature-style</code>): keep <code>?</code> when
converting between function p...</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/94952b2457c4dd3833509159b430d0c1524ff2de"><code>94952b2</code></a>
fix(<code>ts-method-signature-style</code>): do not turn optional or
readonly function p...</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/e4a69dd16245117ce24aa869cbbbc703585db365"><code>e4a69dd</code></a>
refactor: share rule defaults between code and
<code>meta.defaultOptions</code></li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/45c789cc684d568162129c17e3dabc9c04a7a3ef"><code>45c789c</code></a>
chore: lint rule files with eslint-plugin-eslint-plugin</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/44a3c45d39de9ad5748e4a185a18e6382a6fb99e"><code>44a3c45</code></a>
chore: update jsdoccomment, devDep</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/8830b2ea2f27d9afec6e097c2934a302419e12ae"><code>8830b2e</code></a>
fix(<code>ts-prefer-function-type</code>): do not throw on call
signatures inside object...</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/0a1b435e54cd89cc520498ac7a4d53131545b3e4"><code>0a1b435</code></a>
docs: move nojekyll file to /docs</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/a218be3c999f3646790a96247182891188a6c628"><code>a218be3</code></a>
docs: avoid jekyll processing</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/1b3235359338876861138c56e3a5f53175c4cd10"><code>1b32353</code></a>
docs: fix issues with GH Pages</li>
<li><a
href="https://github.com/gajus/eslint-plugin-jsdoc/commit/84eee2cd4a8a75e3b0c0365df114f4a1ff55a410"><code>84eee2c</code></a>
feat(<code>check-tag-names</code>): move matching <a
href="https://github.com/prop"><code>@​prop</code></a> descriptions onto
properties</li>
<li>Additional commits viewable in <a
href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.11...v65.4.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `rollup` from 4.64.9 to 4.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/releases">rollup's
releases</a>.</em></p>
<blockquote>
<h2>v4.65.0</h2>
<h2>4.65.0</h2>
<p><em>2026-10-22</em></p>
<h3>Features</h3>
<ul>
<li>Support synthetic named exports in namespaces when preserving
modules (<a
href="https://redirect.github.com/rollup/rollup/issues/6589">#6589</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fix a situation where unaligned sourcemaps resulted in a wrong
segment (<a
href="https://redirect.github.com/rollup/rollup/issues/6591">#6591</a>)</li>
<li>Forward startup errors on native module load when starting rollup
(<a
href="https://redirect.github.com/rollup/rollup/issues/6592">#6592</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6589">#6589</a>:
Merge synthetic named exports into static namespaces when preserving
modules (<a
href="https://github.com/b84330808"><code>@​b84330808</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6590">#6590</a>:
Stabilize flaky watch test &quot;treats filenames literally, not as
globs&quot; (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6591">#6591</a>:
Use the last sourcemap segment for log locations after its start (<a
href="https://github.com/Dev-next-gen"><code>@​Dev-next-gen</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6592">#6592</a>:
Preserve native module load errors (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6593">#6593</a>:
Close bundles in the Gulp examples (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6594">#6594</a>:
Improve review instructions and resolve audit (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>v4.64.12</h2>
<h2>4.64.12</h2>
<p><em>2026-10-20</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Allow generating logs from transform hooks at position 0 (<a
href="https://redirect.github.com/rollup/rollup/issues/6587">#6587</a>)</li>
<li>Properly handle global or sticky regular expressions for file names
(<a
href="https://redirect.github.com/rollup/rollup/issues/6588">#6588</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6587">#6587</a>:
Fix transform diagnostics at position zero (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6588">#6588</a>:
Match stateful external regular expressions consistently (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>)</li>
</ul>
<h2>v4.64.10</h2>
<h2>4.64.10</h2>
<p><em>2026-10-18</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Avoid breaking lazy loading when a dynamic import only contains
reexports from a manual chunk (<a
href="https://redirect.github.com/rollup/rollup/issues/6583">#6583</a>)</li>
<li>Ensure HTML entities in JSX are properly decoded in the output (<a
href="https://redirect.github.com/rollup/rollup/issues/6584">#6584</a>)</li>
</ul>
<h3>Pull Requests</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's
changelog</a>.</em></p>
<blockquote>
<h2>4.65.0</h2>
<p><em>2026-10-22</em></p>
<h3>Features</h3>
<ul>
<li>Support synthetic named exports in namespaces when preserving
modules (<a
href="https://redirect.github.com/rollup/rollup/issues/6589">#6589</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fix a situation where unaligned sourcemaps resulted in a wrong
segment (<a
href="https://redirect.github.com/rollup/rollup/issues/6591">#6591</a>)</li>
<li>Forward startup errors on native module load when starting rollup
(<a
href="https://redirect.github.com/rollup/rollup/issues/6592">#6592</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6589">#6589</a>:
Merge synthetic named exports into static namespaces when preserving
modules (<a
href="https://github.com/b84330808"><code>@​b84330808</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6590">#6590</a>:
Stabilize flaky watch test &quot;treats filenames literally, not as
globs&quot; (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6591">#6591</a>:
Use the last sourcemap segment for log locations after its start (<a
href="https://github.com/Dev-next-gen"><code>@​Dev-next-gen</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6592">#6592</a>:
Preserve native module load errors (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6593">#6593</a>:
Close bundles in the Gulp examples (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6594">#6594</a>:
Improve review instructions and resolve audit (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.64.12</h2>
<p><em>2026-10-20</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Allow generating logs from transform hooks at position 0 (<a
href="https://redirect.github.com/rollup/rollup/issues/6587">#6587</a>)</li>
<li>Properly handle global or sticky regular expressions for file names
(<a
href="https://redirect.github.com/rollup/rollup/issues/6588">#6588</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6587">#6587</a>:
Fix transform diagnostics at position zero (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6588">#6588</a>:
Match stateful external regular expressions consistently (<a
href="https://github.com/shuaiyafei"><code>@​shuaiyafei</code></a>)</li>
</ul>
<h2>4.64.10</h2>
<p><em>2026-10-18</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Avoid breaking lazy loading when a dynamic import only contains
reexports from a manual chunk (<a
href="https://redirect.github.com/rollup/rollup/issues/6583">#6583</a>)</li>
<li>Ensure HTML entities in JSX are properly decoded in the output (<a
href="https://redirect.github.com/rollup/rollup/issues/6584">#6584</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6583">#6583</a>:
Track manual chunk dependencies when merging small chunks (<a
href="https://github.com/ybai08"><code>@​ybai08</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6584">#6584</a>:
Use decoded values for JSX string attributes (<a
href="https://github.com/luantaraschi"><code>@​luantaraschi</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rollup/rollup/commit/9aac09a39dc1fa297a7b06f1ad6907f7bd41b310"><code>9aac09a</code></a>
4.65.0</li>
<li><a
href="https://github.com/rollup/rollup/commit/56200ea8d14733baab6107a0c75e25f076faf1f2"><code>56200ea</code></a>
Preserve native module load errors (<a
href="https://redirect.github.com/rollup/rollup/issues/6592">#6592</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/61ce2a7505f71892b366598566e44cacc172afa7"><code>61ce2a7</code></a>
Close bundles in the Gulp examples (<a
href="https://redirect.github.com/rollup/rollup/issues/6593">#6593</a>)</li>
<li...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-03 12:44:47 +00:00
2026-10-13 14:17:13 +00:00
2025-09-11 12:46:05 +02:00

Chrome DevTools for agents

npm chrome-devtools-mcp package

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent (such as Antigravity, Claude, Cursor or Copilot) control and inspect a live Chrome browser. It is available as a Model-Context-Protocol (MCP) server and as a CLI. Both give your AI coding assistant access to the full power of Chrome DevTools for reliable automation, in-depth debugging, and performance analysis.

Tool reference | CLI | Skills | Changelog | Contributing | Troubleshooting | Design Principles

Key features

  • Get performance insights: Uses Chrome DevTools to record traces and extract actionable performance insights.
  • Advanced browser debugging: Analyze network requests, take screenshots and check browser console messages (with source-mapped stack traces).
  • Reliable automation. Uses puppeteer to automate actions in Chrome and automatically wait for action results.

Disclaimers

chrome-devtools-mcp exposes content of the browser instance to the MCP clients allowing them to inspect, debug, and modify any data in the browser or DevTools. Avoid sharing sensitive or personal information that you don't want to share with MCP clients.

chrome-devtools-mcp officially supports Google Chrome and Chrome for Testing only. Other Chromium-based browsers may work, but this is not guaranteed, and you may encounter unexpected behavior. Use at your own discretion. We are committed to providing fixes and support for the latest version of Extended Stable Chrome.

Performance tools may send trace URLs to the Google CrUX API to fetch real-user experience data. This helps provide a holistic performance picture by presenting field data alongside lab data. This data is collected by the Chrome User Experience Report (CrUX). To disable this, run with the --no-performance-crux flag.

Usage statistics

Google collects usage statistics (such as tool invocation success rates, latency, and environment information) to improve the reliability and performance of Chrome DevTools MCP.

Data collection is enabled by default. You can opt-out by passing the --no-usage-statistics flag when starting the server:

"args": ["-y", "chrome-devtools-mcp@latest", "--no-usage-statistics"]

Google handles this data in accordance with the Google Privacy Policy.

Google's collection of usage statistics for Chrome DevTools MCP is independent from the Chrome browser's usage statistics. Opting out of Chrome metrics does not automatically opt you out of this tool, and vice-versa.

Collection is disabled if CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS or CI env variables are set.

Update checks

By default, the server periodically checks the npm registry for updates and logs a notification when a newer version is available. You can disable these update checks by setting the CHROME_DEVTOOLS_MCP_NO_UPDATE_CHECKS environment variable.

Requirements

Getting started

Add the following config to your MCP client:

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest"]
    }
  }
}

Note

Using chrome-devtools-mcp@latest ensures that your MCP client will always use the latest version of the Chrome DevTools MCP server.

MCP Client configuration

For setup instructions specific to your editor or agent (e.g. Antigravity, Claude Code, Cursor, VS Code), please see our Client Configurations Guide.

Your first prompt

Enter the following prompt in your MCP Client to check if everything is working:

Check the performance of https://developers.chrome.com

Your MCP client should open the browser and record a performance trace.

Note

The MCP server will start the browser automatically once the MCP client uses a tool that requires a running browser instance. Connecting to the Chrome DevTools MCP server on its own will not automatically start the browser.

CLI

The package also includes the chrome-devtools CLI. Use it to control the browser from your terminal without MCP:

npm i chrome-devtools-mcp@latest -g
chrome-devtools navigate_page 1 --url "https://developers.chrome.com"
chrome-devtools take_screenshot 1 --filePath screenshot.png
chrome-devtools stop

See the CLI guide for all commands and options.

Skills

The package includes skills that teach your agent how to use Chrome DevTools:

Skill Use it to
chrome-devtools Debug and automate pages with the MCP tools.
chrome-devtools-cli Run the CLI and write shell scripts with it.
a11y-debugging Audit and fix accessibility issues.
cookie-debugging Debug cookies, sessions, and authentication.
debug-optimize-lcp Debug and improve Largest Contentful Paint.
memory-leak-debugging Find and fix memory leaks.
troubleshooting Fix connection problems between MCP and Chrome.

Install skills as a plugin

A plugin installs the MCP server and all skills, including the CLI skill:

  • Claude Code: Run /plugin marketplace add ChromeDevTools/chrome-devtools-mcp, then /plugin install chrome-devtools-mcp@chrome-devtools-plugins.
  • Copilot / VS Code: Run Chat: Install Plugin From Source and enter ChromeDevTools/chrome-devtools-mcp.
  • Gemini CLI: Run gemini extensions install --auto-update https://github.com/ChromeDevTools/chrome-devtools-mcp.

See the Client Configurations Guide for more information.

Install skills manually

If your agent does not support plugins, copy the skill folders into the skills directory of your agent. The npm package contains the skills:

npm i chrome-devtools-mcp@latest -g
# Example for Claude Code. Use the skills directory of your agent.
mkdir -p ~/.claude/skills
cp -R "$(npm root -g)/chrome-devtools-mcp/skills/chrome-devtools-cli" ~/.claude/skills/

Important

The chrome-devtools-cli skill requires the CLI. Install the package globally before you use the skill.

Keep skills up to date

Skills describe the tools of a specific version. Update the skills each time you update the MCP server or the CLI. Outdated skills can tell your agent to use tools or parameters that changed.

  • Plugins: Use the update command of the plugin manager of your agent. The Gemini CLI command above enables automatic updates with --auto-update.
  • Manual installs: Update the package, then copy the skill folders again:
npm i chrome-devtools-mcp@latest -g
mkdir -p ~/.claude/skills
cp -R "$(npm root -g)/chrome-devtools-mcp/skills/chrome-devtools-cli" ~/.claude/skills/

Tools

If you run into any issues, checkout our troubleshooting guide. See the full Tool Reference for a complete list of all supported MCP capabilities.

Configuration

Find the complete list of server parameters (e.g., --headless, --isolated, --slim) and how to configure WebSocket connections in the Configuration Guide.

For basic browser tasks only, the --slim flag exposes a reduced set of tools. See the Slim tool reference.

Advanced Usage

For advanced features such as handling concurrent sessions, persistent user data directories, connecting to a running Chrome instance instead of starting a new one, or debugging on Android, see our Advanced Usage Guide.

Integrating as a browser subagent

If you are developing agentic tooling and want to provide an integrated browser subagent as part of your product, we recommend building on top of Chrome DevTools for agents.

For a reference implementation, see the Gemini CLI browser agent documentation.

Languages
TypeScript 97%
JavaScript 3%