Skip to content

deps(ui)(deps): bump the production-dependencies group across 1 directory with 3 updates - #959

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui-apps/production-dependencies-eaa37b0987
Open

deps(ui)(deps): bump the production-dependencies group across 1 directory with 3 updates#959
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui-apps/production-dependencies-eaa37b0987

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 3 updates in the /ui-apps directory: @modelcontextprotocol/ext-apps, react and react-dom.

Updates @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v1.7.5

What's Changed

SDK

  • Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @​victor-openai in #721

Specification

Examples

  • lazy-auth-server: usable on mobile in #714
  • map-server: fix README and code of conduct links in #657

Docs

  • API Docs link for ext-apps/server in #697
  • Add mcp-use inspector badge to supported clients by @​pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: modelcontextprotocol/ext-apps@v1.7.4...v1.7.5

Commits

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, ui. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Test Results Summary

📊 Artifacts


Generated at Mon, 03 Aug 2026 09:27:36 GMT
Commit: 5d07eb8
Run: #1393

@codecov

codecov Bot commented Jul 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

…tory with 3 updates

Bumps the production-dependencies group with 3 updates in the /ui-apps directory: [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom).


Updates `@modelcontextprotocol/ext-apps` from 1.7.4 to 1.7.5
- [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases)
- [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md)
- [Commits](modelcontextprotocol/ext-apps@v1.7.4...v1.7.5)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/ext-apps"
  dependency-version: 1.7.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps(ui)(deps): bump the production-dependencies group in /ui-apps with 3 updates deps(ui)(deps): bump the production-dependencies group across 1 directory with 3 updates Aug 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/ui-apps/production-dependencies-eaa37b0987 branch from 447b042 to f7c316e Compare August 3, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants