Skip to content

chore(deps): update all non-major dependencies - #124

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#124
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change OpenSSF
cytoscape (source) dependencies patch 3.34.1 → 3.34.3 OpenSSF Scorecard
langchain-core (changelog) minor ==1.5.4 → ==1.6.3 OpenSSF Scorecard
langchain-google-genai (source, changelog) minor ==4.3.3 → ==4.4.0 OpenSSF Scorecard
mcp minor ==1.29.0 → ==1.30.0 OpenSSF Scorecard
pdfjs-dist (source) dependencies minor 4.8.69 → 4.10.38 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cytoscape/cytoscape.js (cytoscape)

v3.34.3

Compare Source

Release version v3.34.3

v3.34.2

Compare Source

Release version v3.34.2

modelcontextprotocol/python-sdk (mcp)

v1.30.0

Compare Source

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#​3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#​3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#​3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#​3431, #​3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.
New
  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#​3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#​3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#​3426).
What's Changed
  • [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in #​3396
  • [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in #​3426
  • [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in #​3431
  • [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in #​3448
  • [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in #​3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

Compare Source

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.0...v1.29.1

mozilla/pdf.js (pdfjs-dist)

v4.10.38

Compare Source

This release contains improvements for accessibility, the annotation editor, font conversion, performance, SMasks and the viewer.

Changes since v4.9.155

v4.9.155

Compare Source

This release primarily contains a bugfix for a Node.js-specific regression in the previous release; see #​19145 and #​19149 for context. Moreover, improvements for the annotation editor are included.

Changes since v4.9.124

v4.9.124

Compare Source

This release contains improvements for the annotation editor, form rendering, image conversion, text selection and the viewer.

Changes since v4.8.69

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copilot AI lite review requested due to automatic review settings September 14, 2026 22:12
@renovate
renovate Bot requested a review from a team as a code owner September 14, 2026 22:12
@socket-security

socket-security Bot commented Sep 14, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​pdfjs-dist@​4.8.69 ⏵ 4.10.389710082 +19480
Updatednpm/​cytoscape@​3.34.1 ⏵ 3.34.310010010095100

View full report

@deepsource-io

deepsource-io Bot commented Sep 14, 2026

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 28d3258...7a4d4d7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
Secrets Sep 14, 2026 10:13p.m. Review ↗
Python Sep 14, 2026 10:13p.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

Copilot AI reviewed Sep 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Two moderate findings require regenerating and committing the Cytoscape vendor assets.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates non-major dependencies across frontend demos and A2A/MCP examples.

Changes:

  • Updates Cytoscape and lockfiles.
  • Refreshes MCP and LangChain dependencies.
  • Updates PDF.js for the Drive MCP vendor.
File summaries
File Reviewed change
music/package.json Moderate (3 votes): Regenerate and commit the served Cytoscape asset and license output using the documented vendor command.
music/package-lock.json Cytoscape lockfile update.
instant-stack/package.json Moderate (3 votes): Regenerate and commit the served Cytoscape asset and license output using the documented vendor command.
instant-stack/package-lock.json Cytoscape lockfile update.
a2a/iag-token-exchange/weather_agent/requirements.txt MCP dependency update.
a2a/iag-token-exchange/retriever_agent/requirements.txt MCP and LangChain dependency updates.
a2a/iag-token-exchange/analyst_agent/requirements.txt MCP and LangChain dependency updates.
a2a/iag-mcp-demo/weather_agent/requirements.txt MCP dependency update.
a2a/iag-mcp-demo/retriever_agent/requirements.txt MCP and LangChain dependency updates.
a2a/iag-mcp-demo/orchestrator_agent/requirements.txt LangChain dependency updates.
a2a/iag-mcp-demo/erp_mcp/requirements.txt MCP dependency update.
a2a/iag-mcp-demo/drive_mcp/vendor/package.json PDF.js dependency update.
a2a/iag-mcp-demo/analyst_agent/requirements.txt MCP and LangChain dependency updates.
Review details

Files not reviewed (2)

  • instant-stack/package-lock.json: Generated file
  • music/package-lock.json: Generated file
  • Files reviewed: 10/13 changed files
  • Comments generated: 2
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread instant-stack/package.json
"dependencies": {
"cose-base": "2.2.0",
"cytoscape": "3.34.1",
"cytoscape": "3.34.3",
Comment thread music/package.json
"dependencies": {
"cose-base": "2.2.0",
"cytoscape": "3.34.1",
"cytoscape": "3.34.3",
@cowan-macady

cowan-macady commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

DO NOT MERGE THESE DEPENDENCIES WITHOUT TESTING - EVER -

cowan-macady
cowan-macady requested changes Sep 15, 2026
View reviewed changes

@cowan-macady cowan-macady left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dependencies to be tested - often bugged

@cowan-macady

cowan-macady commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

on no circumstances cytoscape should be upgraded by renovate directly: it needs testing and building

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@cowan-macady cowan-macady cowan-macady requested changes
@alexpriv8 alexpriv8 alexpriv8 approved these changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies renovate SemVer Minor SemVer Patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cowan-macady @alexpriv8