googleapis--mcp-toolbox

Author	SHA1	Message	Date
Twisha Bansal	130e1f144b	Update docs/en/reference/cli.md Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-08-04 14:50:19 +05:30
Twisha Bansal	a346fd2928	docs(cli): document the migrate sub command	2026-08-04 08:57:59 +00:00
dependabot[bot]	77303f09d5	chore(deps): bump body-parser in /docs/en/documentation/configuration/pre-post-processing/js/adk (#3727 ) Bumps and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together. Updates `body-parser` from 2.2.2 to 2.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2025-13466">CVE-2026-12590</a> (<a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/681">expressjs/body-parser#681</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/682">expressjs/body-parser#682</a></li> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/683">expressjs/body-parser#683</a></li> <li>build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/685">expressjs/body-parser#685</a></li> <li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/684">expressjs/body-parser#684</a></li> <li>perf(urlencoded): move empty-body guard to avoid extra function closure by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/647">expressjs/body-parser#647</a></li> <li>Improve ESM compatibility by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/697">expressjs/body-parser#697</a></li> <li>docs: add recommendations for configuring payload limits by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/699">expressjs/body-parser#699</a></li> <li>build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/701">expressjs/body-parser#701</a></li> <li>build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/702">expressjs/body-parser#702</a></li> <li>build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/700">expressjs/body-parser#700</a></li> <li>chore: add explicit type commonjs to package.json by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/711">expressjs/body-parser#711</a></li> <li>deps: update dependencies to latest versions by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/708">expressjs/body-parser#708</a></li> <li>build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/712">expressjs/body-parser#712</a></li> <li>build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/713">expressjs/body-parser#713</a></li> <li>build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/714">expressjs/body-parser#714</a></li> <li>fix: improve limit option validation by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/698">expressjs/body-parser#698</a></li> <li>build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/719">expressjs/body-parser#719</a></li> <li>build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/718">expressjs/body-parser#718</a></li> <li>build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/717">expressjs/body-parser#717</a></li> <li>perf: eliminate conditional check in json strict mode hot path by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/651">expressjs/body-parser#651</a></li> <li>ci: add node.js 26 to text matrix by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/726">expressjs/body-parser#726</a></li> <li>build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/725">expressjs/body-parser#725</a></li> <li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/724">expressjs/body-parser#724</a></li> <li>build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/723">expressjs/body-parser#723</a></li> <li>Upgrade "content-type" by <a href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/728">expressjs/body-parser#728</a></li> <li>refactor: switch to const/let and enable eslint no-var rule by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/729">expressjs/body-parser#729</a></li> <li>Update outdated reference to MDN docs by <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> <li>build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/731">expressjs/body-parser#731</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/732">expressjs/body-parser#732</a></li> <li>chore: updated deps to latest by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/733">expressjs/body-parser#733</a></li> <li>2.3.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/735">expressjs/body-parser#735</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/krzysdz"><code>@krzysdz</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/master/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>2.3.0 / 2026-06-15</h1> <ul> <li>Security fix for <a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a></li> <li>fix: use static exports instead of lazy getters to improve ESM compatibility</li> <li>feat: add subpath exports for individual parsers</li> <li>fix: improve <code>limit</code> option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/698">#698</a>) <ul> <li>Invalid <code>limit</code> values (e.g. unparseable strings or <code>NaN</code>) now throw instead of being silently ignored, which previously disabled size limit enforcement</li> <li><code>null</code> and <code>undefined</code> fall back to the default 100kb limit</li> </ul> </li> <li>deps: <ul> <li>content-type@^2.0.0</li> <li>http-errors@^2.0.1</li> <li>iconv-lite^0.7.2</li> <li>qs@^6.15.2</li> <li>raw-body@^3.0.2</li> <li>type-is@^2.1.0</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/d0f2ace6c74769da7d19b8661b9a01c01bdb0bf7"><code>d0f2ace</code></a> 2.3.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/735">#735</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/7d03f2f9d561dafd1576b137713353c95253512c"><code>7d03f2f</code></a> chore: updated deps to latest (<a href="https://redirect.github.com/expressjs/body-parser/issues/733">#733</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/8024ba7a813e6647ed63832d209a2abb8531267a"><code>8024ba7</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/732">#732</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/32b4ed4639281f04563adcd41d724ab06c9105d4"><code>32b4ed4</code></a> build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/731">#731</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/ff0f6b907106ec5a1b81c80f5a552d921c1bc9a5"><code>ff0f6b9</code></a> docs: update outdated reference to MDN docs (<a href="https://redirect.github.com/expressjs/body-parser/issues/730">#730</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/14d001a9c90abc05891d895ad3e9cf0a65b7b34a"><code>14d001a</code></a> refactor: switch to const/let and enable eslint no-var rule (<a href="https://redirect.github.com/expressjs/body-parser/issues/729">#729</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/37f36a27528e65d7216f2c31c7039d3458c72147"><code>37f36a2</code></a> deps: update content-type and type-is (<a href="https://redirect.github.com/expressjs/body-parser/issues/728">#728</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e1c244bf55fb00a6de4be882b4ed9fc20807d864"><code>e1c244b</code></a> build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/723">#723</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e01087f52192e20e2d0f8726d4f28a8d49d06c87"><code>e01087f</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/724">#724</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/a7698d30280a3e931ea8841396e5d0ac5414e429"><code>a7698d3</code></a> build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/725">#725</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">compare view</a></li> </ul> </details> <br /> Updates `body-parser` from 1.20.5 to 1.20.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2025-13466">CVE-2026-12590</a> (<a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/681">expressjs/body-parser#681</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/682">expressjs/body-parser#682</a></li> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/683">expressjs/body-parser#683</a></li> <li>build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/685">expressjs/body-parser#685</a></li> <li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/684">expressjs/body-parser#684</a></li> <li>perf(urlencoded): move empty-body guard to avoid extra function closure by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/647">expressjs/body-parser#647</a></li> <li>Improve ESM compatibility by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/697">expressjs/body-parser#697</a></li> <li>docs: add recommendations for configuring payload limits by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/699">expressjs/body-parser#699</a></li> <li>build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/701">expressjs/body-parser#701</a></li> <li>build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/702">expressjs/body-parser#702</a></li> <li>build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/700">expressjs/body-parser#700</a></li> <li>chore: add explicit type commonjs to package.json by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/711">expressjs/body-parser#711</a></li> <li>deps: update dependencies to latest versions by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/708">expressjs/body-parser#708</a></li> <li>build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/712">expressjs/body-parser#712</a></li> <li>build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/713">expressjs/body-parser#713</a></li> <li>build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/714">expressjs/body-parser#714</a></li> <li>fix: improve limit option validation by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/698">expressjs/body-parser#698</a></li> <li>build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/719">expressjs/body-parser#719</a></li> <li>build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/718">expressjs/body-parser#718</a></li> <li>build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/717">expressjs/body-parser#717</a></li> <li>perf: eliminate conditional check in json strict mode hot path by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/651">expressjs/body-parser#651</a></li> <li>ci: add node.js 26 to text matrix by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/726">expressjs/body-parser#726</a></li> <li>build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/725">expressjs/body-parser#725</a></li> <li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/724">expressjs/body-parser#724</a></li> <li>build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/723">expressjs/body-parser#723</a></li> <li>Upgrade "content-type" by <a href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/728">expressjs/body-parser#728</a></li> <li>refactor: switch to const/let and enable eslint no-var rule by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/729">expressjs/body-parser#729</a></li> <li>Update outdated reference to MDN docs by <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> <li>build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/731">expressjs/body-parser#731</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/732">expressjs/body-parser#732</a></li> <li>chore: updated deps to latest by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/733">expressjs/body-parser#733</a></li> <li>2.3.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/735">expressjs/body-parser#735</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/krzysdz"><code>@krzysdz</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/master/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>2.3.0 / 2026-06-15</h1> <ul> <li>Security fix for <a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a></li> <li>fix: use static exports instead of lazy getters to improve ESM compatibility</li> <li>feat: add subpath exports for individual parsers</li> <li>fix: improve <code>limit</code> option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/698">#698</a>) <ul> <li>Invalid <code>limit</code> values (e.g. unparseable strings or <code>NaN</code>) now throw instead of being silently ignored, which previously disabled size limit enforcement</li> <li><code>null</code> and <code>undefined</code> fall back to the default 100kb limit</li> </ul> </li> <li>deps: <ul> <li>content-type@^2.0.0</li> <li>http-errors@^2.0.1</li> <li>iconv-lite^0.7.2</li> <li>qs@^6.15.2</li> <li>raw-body@^3.0.2</li> <li>type-is@^2.1.0</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/d0f2ace6c74769da7d19b8661b9a01c01bdb0bf7"><code>d0f2ace</code></a> 2.3.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/735">#735</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/7d03f2f9d561dafd1576b137713353c95253512c"><code>7d03f2f</code></a> chore: updated deps to latest (<a href="https://redirect.github.com/expressjs/body-parser/issues/733">#733</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/8024ba7a813e6647ed63832d209a2abb8531267a"><code>8024ba7</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/732">#732</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/32b4ed4639281f04563adcd41d724ab06c9105d4"><code>32b4ed4</code></a> build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/731">#731</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/ff0f6b907106ec5a1b81c80f5a552d921c1bc9a5"><code>ff0f6b9</code></a> docs: update outdated reference to MDN docs (<a href="https://redirect.github.com/expressjs/body-parser/issues/730">#730</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/14d001a9c90abc05891d895ad3e9cf0a65b7b34a"><code>14d001a</code></a> refactor: switch to const/let and enable eslint no-var rule (<a href="https://redirect.github.com/expressjs/body-parser/issues/729">#729</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/37f36a27528e65d7216f2c31c7039d3458c72147"><code>37f36a2</code></a> deps: update content-type and type-is (<a href="https://redirect.github.com/expressjs/body-parser/issues/728">#728</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e1c244bf55fb00a6de4be882b4ed9fc20807d864"><code>e1c244b</code></a> build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/723">#723</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e01087f52192e20e2d0f8726d4f28a8d49d06c87"><code>e01087f</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/724">#724</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/a7698d30280a3e931ea8841396e5d0ac5414e429"><code>a7698d3</code></a> build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/725">#725</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>	2026-08-03 23:02:22 -04:00
dependabot[bot]	40c84f71b1	chore(deps): bump hono from 4.12.25 to 4.12.32 in /docs/en/documentation/configuration/pre-post-processing/js/adk (#3728 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.25 to 4.12.32. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.32</h2> <h2>What's Changed</h2> <ul> <li>ci: enable reports for type & bundle size check in <a href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li> <li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in <a href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li> <li>fix(sse): emit empty id field to reset Last-Event-ID in <a href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li> <li>test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in <a href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li> <li>fix: use <code>Object.create(null)</code> when parsing query, headers, and params in <a href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li> <li>fix(secure-headers): keep CSP callbacks scoped to their header in <a href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p> <h2>v4.12.31</h2> <h2>What's Changed</h2> <ul> <li>test(context): assert case-insensitive header names in response helpers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5116">honojs/hono#5116</a></li> <li>chore(benchmark): add app.fetch() overhead benchmark by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5117">honojs/hono#5117</a></li> <li>refactor(aws-lambada): remove FIXME in <code>@ts-expect-error</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5130">honojs/hono#5130</a></li> <li>fix(utils/body): reuse cached formData in <code>parseBody()</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5131">honojs/hono#5131</a></li> <li>fix(request): fix multipart boundary mismatch in <code>cloneRawRequest</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5133">honojs/hono#5133</a></li> <li>fix(sse): emit retry feild when retry is <code>0</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5135">honojs/hono#5135</a></li> <li>test(validator): fix misspelled identifier in transform type test by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5136">honojs/hono#5136</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.30...v4.12.31">https://github.com/honojs/hono/compare/v4.12.30...v4.12.31</a></p> <h2>v4.12.30</h2> <h2>What's Changed</h2> <ul> <li>chore(benchmark/routers): bump deps in <a href="https://redirect.github.com/honojs/hono/pull/5107">honojs/hono#5107</a></li> <li>chore(benchmark): remove not used benchmarks in <a href="https://redirect.github.com/honojs/hono/pull/5108">honojs/hono#5108</a></li> <li>chore: update to ts6 in prep for ts7 in <a href="https://redirect.github.com/honojs/hono/pull/5104">honojs/hono#5104</a></li> <li>fix(cache): deduplicate Cache-Control directives case-insensitively in <a href="https://redirect.github.com/honojs/hono/pull/5025">honojs/hono#5025</a></li> <li>fix(compress): do not compress 206 Partial Content responses in <a href="https://redirect.github.com/honojs/hono/pull/5020">honojs/hono#5020</a></li> <li>fix(client): replaceUrlParam should not match a param that prefixes another in <a href="https://redirect.github.com/honojs/hono/pull/5096">honojs/hono#5096</a></li> <li>fix(method-override): set duplex when forwarding a stream body in query mode in <a href="https://redirect.github.com/honojs/hono/pull/5110">honojs/hono#5110</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.29...v4.12.30">https://github.com/honojs/hono/compare/v4.12.29...v4.12.30</a></p> <h2>v4.12.29</h2> <h2>What's Changed</h2> <ul> <li>fix(client): merge function headers with per-request headers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5092">honojs/hono#5092</a></li> <li>chore: fix no-op tsc in test script by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5093">honojs/hono#5093</a></li> <li>fix(lambda-edge): resolve the handler with the value passed to the callback by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5094">honojs/hono#5094</a></li> <li>docs(language): add JSDoc <a href="https://github.com/example"><code>@example</code></a> to languageDetector by <a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> <li>test(workerd): add <code>compatibilityDate</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5100">honojs/hono#5100</a></li> <li>fix(lambda-edge): base64 encode content-encoded response bodies by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5099">honojs/hono#5099</a></li> <li>fix(aws-lambda): treat any non-identity content-encoding as binary by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5101">honojs/hono#5101</a></li> <li>fix(types): strip extra properties from array types in JSONParsed by <a href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li> <li>fix(trie-router): match empty wildcard remainder after regexp param by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5102">honojs/hono#5102</a></li> <li>fix(etag): treat If-None-Match: <code>*</code> as a match by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5084">honojs/hono#5084</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/26d8e42bfff7eb78fc323a01e1d02d63b9dbcc72"><code>26d8e42</code></a> 4.12.32</li> <li><a href="https://github.com/honojs/hono/commit/402eb3abe561914f41ee0f8e37f1d7f211f1ee51"><code>402eb3a</code></a> fix(secure-headers): keep CSP callbacks scoped to their header (<a href="https://redirect.github.com/honojs/hono/issues/5147">#5147</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c85aead088659b98b8d05a1187a07d064e12ffe6"><code>c85aead</code></a> fix: use <code>Object.create(null)</code> when parsing query, headers, and params (<a href="https://redirect.github.com/honojs/hono/issues/5161">#5161</a>)</li> <li><a href="https://github.com/honojs/hono/commit/a88c89dac6e230cbb5f1bf627522d4914b81dffd"><code>a88c89d</code></a> test(cloudflare-workers): add coverage for onClose, onError, send, and close ...</li> <li><a href="https://github.com/honojs/hono/commit/44f884321a1d52e98d45a85634da9d5f4751a43a"><code>44f8843</code></a> fix(sse): emit empty id field to reset Last-Event-ID (<a href="https://redirect.github.com/honojs/hono/issues/5138">#5138</a>)</li> <li><a href="https://github.com/honojs/hono/commit/e36f57dac0615c1bdd03ff1975b6ca8d3dc5917f"><code>e36f57d</code></a> fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (<a href="https://redirect.github.com/honojs/hono/issues/5142">#5142</a>)</li> <li><a href="https://github.com/honojs/hono/commit/bf8608cb77f91c3768311d9977f807ec2f3fd6b9"><code>bf8608c</code></a> ci: enable reports for type & bundle size check (<a href="https://redirect.github.com/honojs/hono/issues/5148">#5148</a>)</li> <li><a href="https://github.com/honojs/hono/commit/cadff88bba34153646c9b35f24d7cc0cb61be913"><code>cadff88</code></a> 4.12.31</li> <li><a href="https://github.com/honojs/hono/commit/64c613ab0f15526b0c0edb25ad0c2989eace2ea1"><code>64c613a</code></a> test(validator): fix misspelled identifier in transform type test (<a href="https://redirect.github.com/honojs/hono/issues/5136">#5136</a>)</li> <li><a href="https://github.com/honojs/hono/commit/aeba9ece778fb24953816fd3517858ff80de958f"><code>aeba9ec</code></a> fix(sse): emit retry feild when retry is <code>0</code> (<a href="https://redirect.github.com/honojs/hono/issues/5135">#5135</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.32">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for hono since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>	2026-08-03 22:58:06 -04:00
dependabot[bot]	1e9051dbf1	chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /docs/en/documentation/configuration/pre-post-processing/go/adk (#3726 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> <h2>Release 1.81.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per <a href="https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md">gRFC A41</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9111">#9111</a>) <ul> <li>Special Thanks: <a href="https://github.com/al4an444"><code>@al4an444</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9081">#9081</a>)</li> </ul> <h2>Release 1.81.0</h2> <h1>Behavior Changes</h1> <ul> <li>balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li> </ul> <h1>Dependencies</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.79.3&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/mcp-toolbox/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-04 02:57:26 +00:00
Twisha Bansal	5b7bacc73b	feat(skill): add review-prs skill for mcp-toolbox (#3743 ) ## Description Adds a `review-prs` maintainer skill for mcp-toolbox. Given a PR number or link, it delivers a propose-only review against the team's Reviewer's Checklist: title/description conventions, linked issue, correctness and edge cases, breaking changes, refactor purity, architecture, tests, docs, security, and new dependencies. Findings are grouped by severity with a suggested verdict and a paste-ready draft comment. The skill is strictly propose-only: it never runs `gh pr review`, `gh pr comment`, `gh pr edit`, `gh pr merge`, or applies labels. It reads source-of-truth conventions live from `CONTRIBUTING.md`, `DEVELOPER.md`, and the maintainer playbook rather than from memory.	2026-08-03 11:24:47 +05:30
An Nguyen	801d589966	feat(bigtable): add admin lifecycle and listing tools (#3596 ) ## Description Introduce a comprehensive suite of Bigtable Administrative MCP tools utilizing InstanceAdminClient and AdminClient from the cloud.google.com/go/bigtable SDK. The implementation should encompass the full lifecycle for four primary Bigtable resources: * Instances * Clusters * Tables * Logical Views This effectively requires creating 20 new tools under internal/tools/bigtable. ## PR Checklist - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/mcp-toolbox/blob/main/CONTRIBUTING.md) - [x] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/mcp-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [x] Ensure the tests and linter pass - [x] Code coverage does not decrease (if any source code was changed) - [x] Appropriate docs were updated (if necessary) - [x] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #3662 --------- Co-authored-by: Yuan Teoh <yuanteoh@google.com>	2026-07-31 22:37:55 -07:00
alextalreja	1b0a8d2ab1	docs(embedding): add description field to vector ingestion sample tool (#3753 ) ## Description Adds a description field to the `vector_string` parameter in the sample vector ingestion tool (`insert_embedding`). Previously, using this sample tool without the description field causes Toolbox to crash with an "unable to parse config file" error. Even though `vector_string` is a hidden parameter, the current Toolbox YAML parser seems to require a description field for all CommonParameters.	2026-07-31 10:08:14 -07:00
Yuan Teoh	d451a5e037	refactor: remove GetEmbeddingModelMap (#3751 ) This PR removes the `GetEmbeddingModelMap`. With this, we parse the primitiveManager to EmbedParams and call the specified embedding model when needed.	2026-07-30 22:10:20 +00:00
Yuan Teoh	aed692ef82	refactor: remove getGroupMap from primitive manager (#3742 )	2026-07-30 14:38:18 -07:00
dependabot[bot]	a642df3bc0	chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#3689 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-29 20:03:29 +00:00
Huan Chen	51893ce478	docs(integrations): standardize mcp tool config examples across docum… (#3741 ) …entation Migrates legacy nested YAML structures to the flattened configuration format (`kind: tool`, `kind: source`) in all integration guides and samples. Fixes formatting inconsistencies, enforces strict naming conventions (kebab-case titles, snake_case tool names), and corrects missing YAML keys in toolset configurations. ## Description > Should include a concise description of the changes (bug or feature), it's > impact, along with a summary of the solution ## PR Checklist > Thank you for opening a Pull Request! Before submitting your PR, there are a > few things you can do to make sure it goes smoothly: - [ ] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/mcp-toolbox/blob/main/CONTRIBUTING.md) - [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/mcp-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #<issue_number_goes_here>	2026-07-29 12:42:18 -07:00
Yufeng He	42570b8336	fix(tools/bigquery): keep the provider error classification in bigquery-execute-sql (#3738 ) ## What Fixes #3716. On the actual query run, `bigquery-execute-sql` wrapped every provider failure in a blanket `NewClientServerError("error running sql", 500, err)`, so a BigQuery 403 from an impersonated service account missing `dataViewer` surfaced as HTTP 500 and connectors showed an opaque bad-gateway instead of anything recoverable. The dry-run path in the same tool already routed through `util.ProcessGcpError`, which made the two stages inconsistent with each other. The actual-run error path now goes through `util.ProcessGcpError` too, the same classification the other GCP tools use (bigtable, firestore, datalineage, and this tool's dry run): 401/403 keep their status with the provider cause attached, and everything else becomes a readable `AgentError` so the model sees the real message (invalid SQL, missing table) instead of a generic 500. ## How One-line swap at the `RunSQL` error site, plus `TestInvokeRunSqlErrorClassification`: a 403 from the provider must come back as `ClientServerError` with code 403 and the Access Denied cause visible, and a 400 must come back as an `AgentError` with the cause visible. Existing tests (`TestInvokeDatasetRestrictions` and the rest of the package) still pass. ## Verification - `go test ./internal/tools/bigquery/bigqueryexecutesql/` - all pass, including the two new classification subtests - `go vet ./internal/tools/bigquery/bigqueryexecutesql/` - clean --------- Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-29 18:13:27 +00:00
Averi Kitsch	1f77f83ade	docs: update banner for new spec (#3745 ) ## Description > Should include a concise description of the changes (bug or feature), it's > impact, along with a summary of the solution ## PR Checklist > Thank you for opening a Pull Request! Before submitting your PR, there are a > few things you can do to make sure it goes smoothly: - [ ] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/mcp-toolbox/blob/main/CONTRIBUTING.md) - [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/mcp-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #<issue_number_goes_here>	2026-07-29 17:05:35 +00:00
Wenxin Du	22942d1890	docs(extensions): add extensions package (#3736 ) This PR establishes the directory structure and documents the experimental MCP Toolbox extensions.	2026-07-29 14:27:34 +00:00
Haoyu Wang	11ae3b5254	feat: improve error messaging on missing envrionment variables (#3718 ) This PR improves environment variable parsing by collecting and reporting all missing variables at once, rather than raising an error on the first failure. By gathering all missing variables into a single error report, we eliminate the tedious "discover-and-fix" loop, making it easier for both developers and AI agents to configure their environments in a single turn. Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-29 06:38:49 +00:00
Ari Heber	4da1600df9	feat(source/bigquery): add apiEndpoint field to override BigQuery API host (#3437 ) ## Description The BigQuery source has no way to set a custom API endpoint today. This means users who need to route BigQuery traffic through a corporate proxy or a local emulator (e.g. for governance, audit, or offline testing) have no supported mechanism — setting `HTTPS_PROXY` does not work because a forward proxy tunnels TLS directly to Google and cannot inspect the request body. This PR adds an optional `apiEndpoint` config field that passes `option.WithEndpoint(...)` to both the high-level (`cloud.google.com/go/bigquery`) and REST (`google.golang.org/api/bigquery/v2`) clients. Both `http://` and `https://` schemes are supported, enabling local emulators as well as HTTPS proxies. The prebuilt config exposes this via the `BIGQUERY_ENDPOINT` environment variable. ## PR Checklist - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/mcp-toolbox/blob/main/CONTRIBUTING.md) - [x] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/mcp-toolbox/issues/new/choose) before writing your code! - [x] Ensure the tests and linter pass - [x] Code coverage does not decrease (if any source code was changed) - [x] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #2766 🦕 --------- Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> Co-authored-by: Yuan Teoh <yuanteoh@google.com>	2026-07-29 06:12:14 +00:00
Yuan Teoh	481b3615b6	docs: remove v1.1.0 from cloudflare docs (#3737 ) cloudflare exceeding 20k files (which made the v1.8.0 docs deployment fail).	2026-07-28 20:44:41 +00:00
dependabot[bot]	3862aa080c	chore(deps): bump body-parser in /docs/en/documentation/getting-started/quickstart/js/adk (#3672 ) Bumps and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together. Updates `body-parser` from 2.2.2 to 2.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2025-13466">CVE-2026-12590</a> (<a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/681">expressjs/body-parser#681</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/682">expressjs/body-parser#682</a></li> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/683">expressjs/body-parser#683</a></li> <li>build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/685">expressjs/body-parser#685</a></li> <li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/684">expressjs/body-parser#684</a></li> <li>perf(urlencoded): move empty-body guard to avoid extra function closure by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/647">expressjs/body-parser#647</a></li> <li>Improve ESM compatibility by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/697">expressjs/body-parser#697</a></li> <li>docs: add recommendations for configuring payload limits by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/699">expressjs/body-parser#699</a></li> <li>build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/701">expressjs/body-parser#701</a></li> <li>build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/702">expressjs/body-parser#702</a></li> <li>build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/700">expressjs/body-parser#700</a></li> <li>chore: add explicit type commonjs to package.json by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/711">expressjs/body-parser#711</a></li> <li>deps: update dependencies to latest versions by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/708">expressjs/body-parser#708</a></li> <li>build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/712">expressjs/body-parser#712</a></li> <li>build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/713">expressjs/body-parser#713</a></li> <li>build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/714">expressjs/body-parser#714</a></li> <li>fix: improve limit option validation by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/698">expressjs/body-parser#698</a></li> <li>build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/719">expressjs/body-parser#719</a></li> <li>build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/718">expressjs/body-parser#718</a></li> <li>build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/717">expressjs/body-parser#717</a></li> <li>perf: eliminate conditional check in json strict mode hot path by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/651">expressjs/body-parser#651</a></li> <li>ci: add node.js 26 to text matrix by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/726">expressjs/body-parser#726</a></li> <li>build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/725">expressjs/body-parser#725</a></li> <li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/724">expressjs/body-parser#724</a></li> <li>build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/723">expressjs/body-parser#723</a></li> <li>Upgrade "content-type" by <a href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/728">expressjs/body-parser#728</a></li> <li>refactor: switch to const/let and enable eslint no-var rule by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/729">expressjs/body-parser#729</a></li> <li>Update outdated reference to MDN docs by <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> <li>build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/731">expressjs/body-parser#731</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/732">expressjs/body-parser#732</a></li> <li>chore: updated deps to latest by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/733">expressjs/body-parser#733</a></li> <li>2.3.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/735">expressjs/body-parser#735</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/krzysdz"><code>@krzysdz</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/master/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>2.3.0 / 2026-06-15</h1> <ul> <li>Security fix for <a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a></li> <li>fix: use static exports instead of lazy getters to improve ESM compatibility</li> <li>feat: add subpath exports for individual parsers</li> <li>fix: improve <code>limit</code> option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/698">#698</a>) <ul> <li>Invalid <code>limit</code> values (e.g. unparseable strings or <code>NaN</code>) now throw instead of being silently ignored, which previously disabled size limit enforcement</li> <li><code>null</code> and <code>undefined</code> fall back to the default 100kb limit</li> </ul> </li> <li>deps: <ul> <li>content-type@^2.0.0</li> <li>http-errors@^2.0.1</li> <li>iconv-lite^0.7.2</li> <li>qs@^6.15.2</li> <li>raw-body@^3.0.2</li> <li>type-is@^2.1.0</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/d0f2ace6c74769da7d19b8661b9a01c01bdb0bf7"><code>d0f2ace</code></a> 2.3.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/735">#735</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/7d03f2f9d561dafd1576b137713353c95253512c"><code>7d03f2f</code></a> chore: updated deps to latest (<a href="https://redirect.github.com/expressjs/body-parser/issues/733">#733</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/8024ba7a813e6647ed63832d209a2abb8531267a"><code>8024ba7</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/732">#732</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/32b4ed4639281f04563adcd41d724ab06c9105d4"><code>32b4ed4</code></a> build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/731">#731</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/ff0f6b907106ec5a1b81c80f5a552d921c1bc9a5"><code>ff0f6b9</code></a> docs: update outdated reference to MDN docs (<a href="https://redirect.github.com/expressjs/body-parser/issues/730">#730</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/14d001a9c90abc05891d895ad3e9cf0a65b7b34a"><code>14d001a</code></a> refactor: switch to const/let and enable eslint no-var rule (<a href="https://redirect.github.com/expressjs/body-parser/issues/729">#729</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/37f36a27528e65d7216f2c31c7039d3458c72147"><code>37f36a2</code></a> deps: update content-type and type-is (<a href="https://redirect.github.com/expressjs/body-parser/issues/728">#728</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e1c244bf55fb00a6de4be882b4ed9fc20807d864"><code>e1c244b</code></a> build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/723">#723</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e01087f52192e20e2d0f8726d4f28a8d49d06c87"><code>e01087f</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/724">#724</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/a7698d30280a3e931ea8841396e5d0ac5414e429"><code>a7698d3</code></a> build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/725">#725</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">compare view</a></li> </ul> </details> <br /> Updates `body-parser` from 1.20.5 to 1.20.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2025-13466">CVE-2026-12590</a> (<a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/681">expressjs/body-parser#681</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/682">expressjs/body-parser#682</a></li> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/683">expressjs/body-parser#683</a></li> <li>build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/685">expressjs/body-parser#685</a></li> <li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/684">expressjs/body-parser#684</a></li> <li>perf(urlencoded): move empty-body guard to avoid extra function closure by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/647">expressjs/body-parser#647</a></li> <li>Improve ESM compatibility by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/697">expressjs/body-parser#697</a></li> <li>docs: add recommendations for configuring payload limits by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/699">expressjs/body-parser#699</a></li> <li>build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/701">expressjs/body-parser#701</a></li> <li>build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/702">expressjs/body-parser#702</a></li> <li>build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/700">expressjs/body-parser#700</a></li> <li>chore: add explicit type commonjs to package.json by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/711">expressjs/body-parser#711</a></li> <li>deps: update dependencies to latest versions by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/708">expressjs/body-parser#708</a></li> <li>build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/712">expressjs/body-parser#712</a></li> <li>build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/713">expressjs/body-parser#713</a></li> <li>build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/714">expressjs/body-parser#714</a></li> <li>fix: improve limit option validation by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/698">expressjs/body-parser#698</a></li> <li>build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/719">expressjs/body-parser#719</a></li> <li>build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/718">expressjs/body-parser#718</a></li> <li>build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/717">expressjs/body-parser#717</a></li> <li>perf: eliminate conditional check in json strict mode hot path by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/651">expressjs/body-parser#651</a></li> <li>ci: add node.js 26 to text matrix by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/726">expressjs/body-parser#726</a></li> <li>build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/725">expressjs/body-parser#725</a></li> <li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/724">expressjs/body-parser#724</a></li> <li>build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/723">expressjs/body-parser#723</a></li> <li>Upgrade "content-type" by <a href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/728">expressjs/body-parser#728</a></li> <li>refactor: switch to const/let and enable eslint no-var rule by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/729">expressjs/body-parser#729</a></li> <li>Update outdated reference to MDN docs by <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> <li>build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/731">expressjs/body-parser#731</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/body-parser/pull/732">expressjs/body-parser#732</a></li> <li>chore: updated deps to latest by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/733">expressjs/body-parser#733</a></li> <li>2.3.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/735">expressjs/body-parser#735</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/krzysdz"><code>@krzysdz</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/730">expressjs/body-parser#730</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/master/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>2.3.0 / 2026-06-15</h1> <ul> <li>Security fix for <a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a></li> <li>fix: use static exports instead of lazy getters to improve ESM compatibility</li> <li>feat: add subpath exports for individual parsers</li> <li>fix: improve <code>limit</code> option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/698">#698</a>) <ul> <li>Invalid <code>limit</code> values (e.g. unparseable strings or <code>NaN</code>) now throw instead of being silently ignored, which previously disabled size limit enforcement</li> <li><code>null</code> and <code>undefined</code> fall back to the default 100kb limit</li> </ul> </li> <li>deps: <ul> <li>content-type@^2.0.0</li> <li>http-errors@^2.0.1</li> <li>iconv-lite^0.7.2</li> <li>qs@^6.15.2</li> <li>raw-body@^3.0.2</li> <li>type-is@^2.1.0</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/d0f2ace6c74769da7d19b8661b9a01c01bdb0bf7"><code>d0f2ace</code></a> 2.3.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/735">#735</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/7d03f2f9d561dafd1576b137713353c95253512c"><code>7d03f2f</code></a> chore: updated deps to latest (<a href="https://redirect.github.com/expressjs/body-parser/issues/733">#733</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/8024ba7a813e6647ed63832d209a2abb8531267a"><code>8024ba7</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/732">#732</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/32b4ed4639281f04563adcd41d724ab06c9105d4"><code>32b4ed4</code></a> build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/731">#731</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/ff0f6b907106ec5a1b81c80f5a552d921c1bc9a5"><code>ff0f6b9</code></a> docs: update outdated reference to MDN docs (<a href="https://redirect.github.com/expressjs/body-parser/issues/730">#730</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/14d001a9c90abc05891d895ad3e9cf0a65b7b34a"><code>14d001a</code></a> refactor: switch to const/let and enable eslint no-var rule (<a href="https://redirect.github.com/expressjs/body-parser/issues/729">#729</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/37f36a27528e65d7216f2c31c7039d3458c72147"><code>37f36a2</code></a> deps: update content-type and type-is (<a href="https://redirect.github.com/expressjs/body-parser/issues/728">#728</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e1c244bf55fb00a6de4be882b4ed9fc20807d864"><code>e1c244b</code></a> build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (<a href="https://redirect.github.com/expressjs/body-parser/issues/723">#723</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/e01087f52192e20e2d0f8726d4f28a8d49d06c87"><code>e01087f</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/724">#724</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/a7698d30280a3e931ea8841396e5d0ac5414e429"><code>a7698d3</code></a> build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/725">#725</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/mcp-toolbox/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dishaprakash <57954147+dishaprakash@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-28 15:39:49 +00:00
dependabot[bot]	0d6767b9db	chore(deps): bump fast-uri from 3.1.2 to 3.1.4 in /docs/en/documentation/getting-started/quickstart/js/genkit (#3690 ) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.4</h2> <h2>⚠️ Security Release</h2> <p>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p> <h2>v3.1.3</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fixes: <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6">https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3">https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a> Bumped v3.1.4</li> <li><a href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a> fix: reject literal backslash in URI authority</li> <li><a href="https://github.com/fastify/fast-uri/commit/0549fe35b0d482233f3be2816439f3ec803603fa"><code>0549fe3</code></a> Bumped v3.1.3</li> <li><a href="https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05"><code>2a6d357</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-28 08:38:34 -07:00
dependabot[bot]	8699a8dc55	chore(deps): bump hono from 4.12.25 to 4.12.32 in /docs/en/documentation/getting-started/quickstart/js/adk (#3688 ) Bumps [hono](https://github.com/honojs/hono) from 4.12.25 to 4.12.32. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.32</h2> <h2>What's Changed</h2> <ul> <li>ci: enable reports for type & bundle size check in <a href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li> <li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in <a href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li> <li>fix(sse): emit empty id field to reset Last-Event-ID in <a href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li> <li>test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in <a href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li> <li>fix: use <code>Object.create(null)</code> when parsing query, headers, and params in <a href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li> <li>fix(secure-headers): keep CSP callbacks scoped to their header in <a href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p> <h2>v4.12.31</h2> <h2>What's Changed</h2> <ul> <li>test(context): assert case-insensitive header names in response helpers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5116">honojs/hono#5116</a></li> <li>chore(benchmark): add app.fetch() overhead benchmark by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5117">honojs/hono#5117</a></li> <li>refactor(aws-lambada): remove FIXME in <code>@ts-expect-error</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5130">honojs/hono#5130</a></li> <li>fix(utils/body): reuse cached formData in <code>parseBody()</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5131">honojs/hono#5131</a></li> <li>fix(request): fix multipart boundary mismatch in <code>cloneRawRequest</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5133">honojs/hono#5133</a></li> <li>fix(sse): emit retry feild when retry is <code>0</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5135">honojs/hono#5135</a></li> <li>test(validator): fix misspelled identifier in transform type test by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5136">honojs/hono#5136</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.30...v4.12.31">https://github.com/honojs/hono/compare/v4.12.30...v4.12.31</a></p> <h2>v4.12.30</h2> <h2>What's Changed</h2> <ul> <li>chore(benchmark/routers): bump deps in <a href="https://redirect.github.com/honojs/hono/pull/5107">honojs/hono#5107</a></li> <li>chore(benchmark): remove not used benchmarks in <a href="https://redirect.github.com/honojs/hono/pull/5108">honojs/hono#5108</a></li> <li>chore: update to ts6 in prep for ts7 in <a href="https://redirect.github.com/honojs/hono/pull/5104">honojs/hono#5104</a></li> <li>fix(cache): deduplicate Cache-Control directives case-insensitively in <a href="https://redirect.github.com/honojs/hono/pull/5025">honojs/hono#5025</a></li> <li>fix(compress): do not compress 206 Partial Content responses in <a href="https://redirect.github.com/honojs/hono/pull/5020">honojs/hono#5020</a></li> <li>fix(client): replaceUrlParam should not match a param that prefixes another in <a href="https://redirect.github.com/honojs/hono/pull/5096">honojs/hono#5096</a></li> <li>fix(method-override): set duplex when forwarding a stream body in query mode in <a href="https://redirect.github.com/honojs/hono/pull/5110">honojs/hono#5110</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.29...v4.12.30">https://github.com/honojs/hono/compare/v4.12.29...v4.12.30</a></p> <h2>v4.12.29</h2> <h2>What's Changed</h2> <ul> <li>fix(client): merge function headers with per-request headers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5092">honojs/hono#5092</a></li> <li>chore: fix no-op tsc in test script by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5093">honojs/hono#5093</a></li> <li>fix(lambda-edge): resolve the handler with the value passed to the callback by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5094">honojs/hono#5094</a></li> <li>docs(language): add JSDoc <a href="https://github.com/example"><code>@example</code></a> to languageDetector by <a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> <li>test(workerd): add <code>compatibilityDate</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5100">honojs/hono#5100</a></li> <li>fix(lambda-edge): base64 encode content-encoded response bodies by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5099">honojs/hono#5099</a></li> <li>fix(aws-lambda): treat any non-identity content-encoding as binary by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5101">honojs/hono#5101</a></li> <li>fix(types): strip extra properties from array types in JSONParsed by <a href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li> <li>fix(trie-router): match empty wildcard remainder after regexp param by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5102">honojs/hono#5102</a></li> <li>fix(etag): treat If-None-Match: <code>*</code> as a match by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5084">honojs/hono#5084</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/26d8e42bfff7eb78fc323a01e1d02d63b9dbcc72"><code>26d8e42</code></a> 4.12.32</li> <li><a href="https://github.com/honojs/hono/commit/402eb3abe561914f41ee0f8e37f1d7f211f1ee51"><code>402eb3a</code></a> fix(secure-headers): keep CSP callbacks scoped to their header (<a href="https://redirect.github.com/honojs/hono/issues/5147">#5147</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c85aead088659b98b8d05a1187a07d064e12ffe6"><code>c85aead</code></a> fix: use <code>Object.create(null)</code> when parsing query, headers, and params (<a href="https://redirect.github.com/honojs/hono/issues/5161">#5161</a>)</li> <li><a href="https://github.com/honojs/hono/commit/a88c89dac6e230cbb5f1bf627522d4914b81dffd"><code>a88c89d</code></a> test(cloudflare-workers): add coverage for onClose, onError, send, and close ...</li> <li><a href="https://github.com/honojs/hono/commit/44f884321a1d52e98d45a85634da9d5f4751a43a"><code>44f8843</code></a> fix(sse): emit empty id field to reset Last-Event-ID (<a href="https://redirect.github.com/honojs/hono/issues/5138">#5138</a>)</li> <li><a href="https://github.com/honojs/hono/commit/e36f57dac0615c1bdd03ff1975b6ca8d3dc5917f"><code>e36f57d</code></a> fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (<a href="https://redirect.github.com/honojs/hono/issues/5142">#5142</a>)</li> <li><a href="https://github.com/honojs/hono/commit/bf8608cb77f91c3768311d9977f807ec2f3fd6b9"><code>bf8608c</code></a> ci: enable reports for type & bundle size check (<a href="https://redirect.github.com/honojs/hono/issues/5148">#5148</a>)</li> <li><a href="https://github.com/honojs/hono/commit/cadff88bba34153646c9b35f24d7cc0cb61be913"><code>cadff88</code></a> 4.12.31</li> <li><a href="https://github.com/honojs/hono/commit/64c613ab0f15526b0c0edb25ad0c2989eace2ea1"><code>64c613a</code></a> test(validator): fix misspelled identifier in transform type test (<a href="https://redirect.github.com/honojs/hono/issues/5136">#5136</a>)</li> <li><a href="https://github.com/honojs/hono/commit/aeba9ece778fb24953816fd3517858ff80de958f"><code>aeba9ec</code></a> fix(sse): emit retry feild when retry is <code>0</code> (<a href="https://redirect.github.com/honojs/hono/issues/5135">#5135</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.32">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for hono since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 07:51:28 -07:00
dependabot[bot]	c4dc2ceb00	chore(deps): bump fast-uri from 3.1.2 to 3.1.4 in /docs/en/documentation/configuration/pre-post-processing/js/adk (#3729 ) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.4</h2> <h2>⚠️ Security Release</h2> <p>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p> <h2>v3.1.3</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fixes: <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6">https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3">https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a> Bumped v3.1.4</li> <li><a href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a> fix: reject literal backslash in URI authority</li> <li><a href="https://github.com/fastify/fast-uri/commit/0549fe35b0d482233f3be2816439f3ec803603fa"><code>0549fe3</code></a> Bumped v3.1.3</li> <li><a href="https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05"><code>2a6d357</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.2&new-version=3.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/mcp-toolbox/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-27 23:37:17 -07:00
release-please[bot]	44d1a05016	chore(main): release 1.8.0 (#3653 ) Publish to MCP Registry / publish (push) Has been cancelled 🤖 I have created a release beep boop --- ## [1.8.0](https://github.com/googleapis/mcp-toolbox/compare/v1.7.0...v1.8.0) (2026-07-28) ### Features * Add `groups` support ([#3605](https://github.com/googleapis/mcp-toolbox/issues/3605)) ([`e75ec3b`](https://github.com/googleapis/mcp-toolbox/commit/e75ec3b5c84dfad5b69f2d42ec2d3408f22e2463)) * prebuilt: Migrate skills-repo toolsets to `kind: group` with descriptions ([#3595](https://github.com/googleapis/mcp-toolbox/issues/3595)) ([`b895b36`](https://github.com/googleapis/mcp-toolbox/commit/b895b36b10eb81dc609216fc5f76ae800d1c65f4)) * server: Add `/healthz` endpoint for container health checks ([#3060](https://github.com/googleapis/mcp-toolbox/issues/3060)) ([`d5aefbc`](https://github.com/googleapis/mcp-toolbox/commit/d5aefbc9e9bd914042224daaf0d4f9257ac01c88)) * skills: Add `--group` flag to generate a skill from one group ([#3585](https://github.com/googleapis/mcp-toolbox/issues/3585)) ([`c1abd4f`](https://github.com/googleapis/mcp-toolbox/commit/c1abd4fc4fcdfa52ba20aaf7d92424ca189c7282)) * skills: Default `--name` to `--group`, `--toolset`, or single `--prebuilt` name ([#3586](https://github.com/googleapis/mcp-toolbox/issues/3586)) ([`2b33b08`](https://github.com/googleapis/mcp-toolbox/commit/2b33b08c3a220657c8ab6a3e0ce1274badc2fe15)) * skills: Make description optional during skills gen ([#3584](https://github.com/googleapis/mcp-toolbox/issues/3584)) ([`d0a8f14`](https://github.com/googleapis/mcp-toolbox/commit/d0a8f14cbec1f9770da7f82a07b4e480f5a4c6a7)) * tool/looker: Add `get_field_value_suggestions` tool ([#3696](https://github.com/googleapis/mcp-toolbox/issues/3696)) ([`3debe81`](https://github.com/googleapis/mcp-toolbox/commit/3debe8113fe2c9af012a7369658bb7a9e64f40f4)) * tools/dataplex-update-data-product-aspects: Add dataplex-update-data-product-aspects tool ([#3607](https://github.com/googleapis/mcp-toolbox/issues/3607)) ([`f940937`](https://github.com/googleapis/mcp-toolbox/commit/f94093725c35189051321778576f801748ead226)) * Update draft specs to 2026-07-28 ([#3699](https://github.com/googleapis/mcp-toolbox/issues/3699)) ([`cf128ff`](https://github.com/googleapis/mcp-toolbox/commit/cf128ff94c4d39aea1eb17caa706ff0b73d8c780)) ### Bug Fixes * Re-add name validation to tools name ([#3654](https://github.com/googleapis/mcp-toolbox/issues/3654)) ([`944f6ce`](https://github.com/googleapis/mcp-toolbox/commit/944f6ce97bc77a92a052de92b88f0fc09ac7578c)) * Re-add tool validation during startup ([#3705](https://github.com/googleapis/mcp-toolbox/issues/3705)) ([`25ce953`](https://github.com/googleapis/mcp-toolbox/commit/25ce953559a201183f066f566dca5fb597efca39)) * server: Sort default toolset alphabetically for stable ordering ([#3539](https://github.com/googleapis/mcp-toolbox/issues/3539)) ([`e5da24c`](https://github.com/googleapis/mcp-toolbox/commit/e5da24c5dfd2208c7e947a20e58a2e2c82236241)) * source/cloud-sql-admin: Validate source instance for backup-run restore ([#3555](https://github.com/googleapis/mcp-toolbox/issues/3555)) ([`3ebe500`](https://github.com/googleapis/mcp-toolbox/commit/3ebe500ef7b27608464e891c7458df630ea4aab6)) * source/dataplex: Cleanup Dataplex Data Product resources that may have leaked due to previously aborted tests ([#3627](https://github.com/googleapis/mcp-toolbox/issues/3627)) ([`3fb5a3f`](https://github.com/googleapis/mcp-toolbox/commit/3fb5a3f2cdf42cbd078720df3369dbc33788c6b1)) * source/http: Block CGNAT 100.64.0.0/10 in default SSRF guard ([#3625](https://github.com/googleapis/mcp-toolbox/issues/3625)) ([`a0f36f4`](https://github.com/googleapis/mcp-toolbox/commit/a0f36f42c33df52727e934549e7d6ca7576fe9ac)) * tools/looker: Enhance looker-run-dashboard to handle result maker structures and merge queries ([#3698](https://github.com/googleapis/mcp-toolbox/issues/3698)) ([`7666bc0`](https://github.com/googleapis/mcp-toolbox/commit/7666bc08debdc4f81e1c6f95f41a1dbd9db3b365)) * tools/looker: Log request/response traces at debug, not error ([#3552](https://github.com/googleapis/mcp-toolbox/issues/3552)) ([`c3ad445`](https://github.com/googleapis/mcp-toolbox/commit/c3ad4451e8592606ce686d042623f9aa8142317f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> v1.8.0	2026-07-28 01:25:29 +00:00
Yuan Teoh	9d282e933d	chore: update hugo for release (#3724 )	2026-07-27 17:52:52 -07:00
Yuan Teoh	25ce953559	fix: re-add tool validation during startup (#3705 ) Tool validation is added during server startup, except for during skills generation.	2026-07-28 00:33:20 +00:00
Yuan Teoh	cf128ff94c	feat: update draft specs to 2026-07-28 (#3699 ) This PR updates draft to `2026-07-28`. The `enable-draft-specs` flag will now have no effects towards the server. `DRAFT-2026-v1` will now resolve to unsupported protocol version error. --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-07-27 23:55:28 +00:00
Yuan Teoh	8903cbe87a	refactor: remove getPromptMap from primitive manager (#3701 ) This PR does the following: 1. remove `GetPromptsMap` from primitive manager.	2026-07-27 23:16:09 +00:00
Yuan Teoh	7510d9b77e	chore(source/http): update fmt.Print to logger (#3665 ) We shouldn't be printing directly using `fmt.Printf`, this might cause issue when user is running with stdio as the client will read it as an response or msg from the server. Update to use warning log instead.	2026-07-27 22:27:43 +00:00
Yuan Teoh	e1a43726b9	chore: update vendor prefix for auth params in draft spec (#3719 ) This is only updated for draft specs to prevent breaking change on previous versions.	2026-07-27 20:05:04 +00:00
Saivedant Hava	d5aefbc9e9	feat(server): add /healthz endpoint for container health checks (#3060 ) Fixes #2644 ## Summary Adds a `/healthz` endpoint to the Toolbox HTTP server so container orchestrators (Kubernetes liveness/readiness probes, Docker `HEALTHCHECK`, Cloud Run startup probes) have a dedicated, lightweight path to hit. The response is `HTTP 200` with a JSON body of `{"status":"ok"}`, so probes can check either the status code or the payload depending on their configuration. ## Why a separate endpoint The existing `/` handler is a landing page that returns a greeting string. Reusing it for health checks is fine today but couples probe behavior to a user-facing route, and the non-JSON body makes it awkward for tooling that parses health responses. Giving probes their own path follows the convention most Go services already use and keeps `/` free to evolve as a human-facing entry point. ## Implementation - Registered `r.Get("/healthz", ...)` in `internal/server/server.go` right after the default `/` handler, so it inherits the same CORS and host-check middleware already applied at the router level. - Returns `Content-Type: application/json` with body `{"status":"ok"}`. - No new dependencies. ## Testing Added `TestHealthz` in `internal/server/server_test.go`. It follows the same pattern as `TestServe`: spins up a real server on a free port, sends a GET to `/healthz`, and verifies the status code, the `Content-Type` header, and the JSON body. Runs on port `5004` to avoid collisions with other tests in the package. ``` $ go test ./internal/server/ -run "TestServe\|TestHealthz" -count=1 ok github.com/googleapis/mcp-toolbox/internal/server 1.283s $ go test ./internal/server/ -count=1 ok github.com/googleapis/mcp-toolbox/internal/server 2.220s ``` Also verified `go vet ./internal/server/...` and `gofmt -l` are clean. --------- Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>	2026-07-27 19:05:36 +00:00
Anas Khan	1c3bf492c7	fix(source/cockroachdb): detect existing LIMIT regardless of whitespace (#3554 ) `ApplyQueryLimits` decides whether to append a `LIMIT` to a SELECT by checking `strings.Contains(strings.ToUpper(sql), " LIMIT ")`. That substring is anchored on single spaces, so any query that separates `LIMIT` with other whitespace, for example a multiline or tab-formatted statement, is treated as having no limit and gets a SECOND one appended: ``` SELECT * FROM users LIMIT 50 -> SELECT *\nFROM users\nLIMIT 50 LIMIT 100 (invalid SQL) ``` The trailing append branch already trims arbitrary whitespace, so the mismatch is purely in this detection. The fix replaces the substring check with a precompiled word-boundary regex `(?i)\bLIMIT\b`, which matches `LIMIT` regardless of the surrounding whitespace or case. This mirrors the package's existing `regexp.MustCompile` style (see `RedactSQL` in the same file). The append/trim logic is unchanged. Three "already has LIMIT" cases (multiline, lowercase multiline, tab) were added to `TestApplyQueryLimits`. ### PR Checklist - [ ] Make sure to open an issue as a bug/issue before writing your code! - [x] Ensure the tests and linter pass - [x] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - none needed (behavior fix) - [ ] Make sure to add `!` if this involves a breaking change - not breaking ### Issue Reference No tracking issue exists. This is a small, self-contained bug fix. Either open a short bug issue first and use `Fixes #<n> 🦕`, or note in the PR that it is a tiny self-contained fix (precedent: #3512 merged without a prior issue). --------- Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>	2026-07-27 18:42:36 +00:00
Twisha Bansal	e8e5164235	chore: remove groups list/get handlers from non-draft versions (#3709 ) ## Description The `groups/list` and `groups/get` handlers were defined in the `v20241105`, `v20250326`, `v20250618`, and `v20251125` MCP protocol versions but were never routed by their `ProcessMethod` switch statements : only `vdraft` actually exposes the groups feature. This PR removes that dead code from the four non-draft versions. The groups feature is untouched in `vdraft`.	2026-07-27 18:09:57 +00:00
Tejas Singh	f94093725c	feat(tools/dataplex-update-data-product-aspects): Add dataplex-update-data-product-aspects tool (#3607 ) This PR adds the `dataplex-update-data-product-aspects` tool to allow agent to update metadata aspects (such as documentation `overview` or contract `refresh-cadence`) on existing Data Product Entries in Google Cloud Dataplex (Knowledge Catalog). Additionally, it adds the `dataplex-get-operation` tool to the `data-products` toolset. Changes overview: - New Tool (`dataplex-update-data-product-aspects`): - Implemented the tool with required parameters `locationId`, `dataProductId`, and `aspects`. - Configured detailed schema and payload documentation on the `aspects` and `aspectSchema` parameters (`projectId`, `locationId`, `aspectTypeId`, and specific fields under `data` for `overview` and `refresh-cadence` aspects). - Documentation & Prebuilt Configurations: - Updated `internal/prebuiltconfigs/tools/dataplex.yaml` and corresponding doc markdown to include detailed payload documentation for `update_data_product_aspects` and registered the tool under the `data-products` toolset. - Updated `docs/en/integrations/knowledge-catalog/source.md` and related tool references for `update_data_product_aspects` and `get_operation`. - Integration Tests: - Added unit and end-to-end integration tests for `update_data_product_aspects`. --------- Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-27 17:43:36 +00:00
Twisha Bansal	4f7688402b	docs(skills): add triage-issues skill for mcp-toolbox (#3694 ) ## Summary - Add the `triage-issues` Agent Skill: propose labels (type / product / priority / status), check duplicates, verify bug completeness, and draft triage comments. Propose-only, never mutates issues. - Bundles the maintainer playbook as a reference via a relative `references/` symlink (Agent Skills convention), so the installed skill is self-contained.	2026-07-27 19:08:36 +05:30
Twisha Bansal	b895b36b10	feat(prebuilt): migrate skills-repo toolsets to kind: group with descriptions (#3595 ) ## Description Migrates prebuilt config toolsets to `kind: group` with descriptions, so prebuilt skill generation sources each group's description directly from the config. Descriptions are the canonical text from the published `gemini-cli-extensions` SKILL.md frontmatter (not hand-written). Only toolsets backed by a published skills repo are migrated. Toolsets with no matching published skill are intentionally left as `kind: toolset`. Stacked on #3587 --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-27 11:10:58 +00:00
Twisha Bansal	2b33b08c3a	feat(skills): default --name to --group, --toolset, or single --prebuilt name (#3586 ) ## Description Makes `--name` optional for `skills-generate` whenever the command produces a single skill. When `--name` is omitted, `resolveSkillName` picks a name using the first rule that applies: 1. `--name`, if you set it explicitly 2. the `--group` name 3. the `--toolset` name 4. the config file name, when exactly one `--prebuilt` is given If none of these apply (a custom `--config`, multiple `--prebuilt` configs, or no config), `--name` is still required and the command errors clearly. So a group or toolset skill can now be generated with no naming flags: ```bash toolbox --prebuilt alloydb-postgres skills-generate --group greeting # -> skill named "greeting" ``` Unchanged: when no group flag is set and multiple groups exist, `--name` still acts as a prefix (`<name>-<group>`) to keep skill names from colliding. Based on #3585 --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-27 06:14:39 +00:00
Twisha Bansal	c1abd4fc4f	feat(skills): add --group flag to generate a skill from one group (#3585 ) ## Description Adds a `--group <name>` flag to `skills-generate` that selects a single named group and generates one skill (named exactly `--name`) from that group's tools. The description follows the same precedence as PR #3584: the group's own `description` is used when present, `--description` is the fallback. `--group` is mutually exclusive with `--toolset`. This complements the existing behaviors: - no flag + multiple groups → one skill per group (`--name-<group>`) - `--toolset X` → single skill from toolset X (legacy; uses `--description`) - `--group X` → single skill from group X (uses group description, falls back to `--description`) Based on https://github.com/googleapis/mcp-toolbox/pull/3584 --------- Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-27 03:56:00 +00:00
Yuan Teoh	f517dcd74c	refactor: clean tool and remove GetSourceFromMap (#3703 ) This PR does the following: 1. Rename `SourceProvider` to `SourceManager` 2. Remove `GetCompatibleSource` and `GetCompatibleSourceFromMap` function. 3. Add `ValidateSource()` (used to validate source compatibility with tool) and `GetSource()` (used to retrieve source during manifest generation to avoid parsing map) function to Tool interface. 4. Remove `GetSourcesMap()` from primitives manager.	2026-07-24 20:19:47 +00:00
Muskan Jain	3debe8113f	feat(tool/looker): add get_field_value_suggestions tool (#3696 ) ## Description This PR implements a new Looker MCP tool `get_field_value_suggestions` to expose the Looker suggestions API (`GET /models/{model}/views/{explore}/fields/{field}/suggestions`). ### Tool calls and frequency for a sample prompt Prompt: "Get the query count from system activity history for completed runs where the source is 'scheduled'" Before (without suggestions tool): * `mcp_mylocalLookerWithOauth_get_models`: 1 time * `mcp_mylocalLookerWithOauth_get_explores`: 1 time * `mcp_mylocalLookerWithOauth_get_dimensions`: 1 time * `mcp_mylocalLookerWithOauth_get_measures`: 1 time * `mcp_mylocalLookerWithOauth_query`: 5 times (explored source values, checked status strings, corrected bad filters, executed query, and verified output) After (with suggestions tool): * `mcp_looker-local_get_models`: 1 time * `mcp_looker-local_get_explores`: 1 time * `mcp_looker-local_get_dimensions`: 1 time * `mcp_looker-local_get_measures`: 1 time * `mcp_looker-local_get_field_value_suggestions`: 2 times (retrieved "scheduled_task" and "complete" values) * `mcp_looker-local_query`: 1 time (executed final query with correct filters directly) ### Summary of the Solution - Created the `get_field_value_suggestions` tool wrapping the Looker SDK. - Exposed the `suggestable` boolean property in the `get_dimensions` tool metadata output, allowing LLM planning engines to identify which dimensions support suggestions lookup. - Wrapped the returned suggestions list in a JSON object (`{"suggestions": [...]}`) instead of a raw JSON array to satisfy strict client schema validation requirements and prevent `structuredContent` parsing errors. - Tuned parameter descriptions and prompt suggestions inside the `query` tool and documentation to guide the LLM planning engine to use this tool when unsure of valid values. - Added comprehensive integration tests, unit tests, and validation test cases. --- 🛠️ Fixes #3695 🦕 --------- Co-authored-by: Mike DeAngelo <drstrangelove@google.com>	2026-07-24 19:43:33 +00:00
Twisha Bansal	d0a8f14cbe	feat(skills): make description optional during skills gen (#3584 ) ## Description Once description becomes optional, skills generation can take in description directly from `Groups`. Note: group description takes precedence when present, `--description` is used otherwise, and both may be empty. Based on [#3605](https://github.com/googleapis/mcp-toolbox/pull/3605) --------- Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>	2026-07-25 00:25:31 +05:30
Twisha Bansal	e75ec3b5c8	feat: add groups support (#3605 ) ## Description Master PR for adding groups support to MCP Toolbox. Groups currently contain tools and prompts. --------- Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-07-24 23:24:47 +05:30
Dr. Strangelove	7666bc08de	fix(tools/looker): Enhance looker-run-dashboard to handle result maker structures and merge queries (#3698 ) ## Description Not all dashboard tiles have a Query structure in the top layer. They were not handled properly. This update handles query structures if they are nested in result_makers or in merge result source queries. ## PR Checklist > Thank you for opening a Pull Request! Before submitting your PR, there are a > few things you can do to make sure it goes smoothly: - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/mcp-toolbox/blob/main/CONTRIBUTING.md) - [x] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/mcp-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [x] Ensure the tests and linter pass - [x] Code coverage does not decrease (if any source code was changed) - [x] Appropriate docs were updated (if necessary) - [x] Make sure to add `!` if this involve a breaking change 🛠️ Fixes #3621	2026-07-23 15:26:58 -04:00
Twisha Bansal	8e253e5b5b	docs: add maintainer playbook (#3693 ) ## Summary - Add `maintainer-playbook.md`: the issue lifecycle, triage + SLOs, releasing (versioned/continuous/npm/PyPI), and CI/repo automation. - Move maintainer-only content out of `DEVELOPER.md` into the playbook. `DEVELOPER.md` now points to it and stays focused on contributing. --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-07-23 21:33:44 +05:30
dependabot[bot]	f6927bcb55	chore(deps): bump brace-expansion from 2.1.1 to 2.1.2 in /docs/en/documentation/getting-started/quickstart/js/genkit (#3671 ) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.1.1 to 2.1.2. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/9e67a3b151e418679ac4800f31f874ec6d220b4a"><code>9e67a3b</code></a> 2.1.2</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265"><code>835d6be</code></a> fix: v2 backport for CVE-2026-13149 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/123">#123</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.1.1...v2.1.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=brace-expansion&package-manager=npm_and_yarn&previous-version=2.1.1&new-version=2.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/mcp-toolbox/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dishaprakash <57954147+dishaprakash@users.noreply.github.com>	2026-07-23 18:29:08 +05:30
dependabot[bot]	bd35ede25f	chore(deps): bump axios from 1.17.0 to 1.18.1 in /docs/en/documentation/getting-started/quickstart/js/genAI (#3668 ) Bumps [axios](https://github.com/axios/axios) from 1.17.0 to 1.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.18.1 — June 21, 2026</h2> <p>This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (<a href="https://redirect.github.com/axios/axios/issues/10913">#10913</a>)</li> <li>Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (<a href="https://redirect.github.com/axios/axios/issues/10917">#10917</a>, <a href="https://redirect.github.com/axios/axios/issues/10930">#10930</a>, <a href="https://redirect.github.com/axios/axios/issues/10942">#10942</a>, <a href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li> <li>Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (<a href="https://redirect.github.com/axios/axios/issues/10959">#10959</a>, <a href="https://redirect.github.com/axios/axios/issues/11021">#11021</a>)</li> <li>AxiosURLSearchParams: Switched the encoder callback to an arrow function so <code>encoder.call(this)</code> receives the <code>AxiosURLSearchParams</code> instance correctly. (<a href="https://redirect.github.com/axios/axios/issues/11019">#11019</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p>Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (<a href="https://redirect.github.com/axios/axios/issues/11007">#11007</a>, <a href="https://redirect.github.com/axios/axios/issues/11010">#11010</a>, <a href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>, <a href="https://redirect.github.com/axios/axios/issues/11025">#11025</a>)</p> </li> <li> <p>Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (<a href="https://redirect.github.com/axios/axios/issues/11011">#11011</a>, <a href="https://redirect.github.com/axios/axios/issues/11012">#11012</a>, <a href="https://redirect.github.com/axios/axios/issues/11013">#11013</a>, <a href="https://redirect.github.com/axios/axios/issues/11014">#11014</a>, <a href="https://redirect.github.com/axios/axios/issues/11015">#11015</a>, <a href="https://redirect.github.com/axios/axios/issues/11016">#11016</a>, <a href="https://redirect.github.com/axios/axios/issues/11017">#11017</a>, <a href="https://redirect.github.com/axios/axios/issues/11026">#11026</a>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><a href="https://github.com/webdevelopersrinu"><code>@webdevelopersrinu</code></a> (<a href="https://redirect.github.com/axios/axios/issues/10913">#10913</a>)</li> <li><a href="https://github.com/sijie-Z"><code>@sijie-Z</code></a> (<a href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li> <li><a href="https://github.com/bartlomieju"><code>@bartlomieju</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>)</li> <li><a href="https://github.com/JSap0914"><code>@JSap0914</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11019">#11019</a>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.18.0...v1.18.1">Full Changelog</a></p> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/a209bfb1e5dcbce3cecbf4bd955339d006358887"><code>a209bfb</code></a> chore(release): prepare release 1.18.1 (<a href="https://redirect.github.com/axios/axios/issues/11027">#11027</a>)</li> <li><a href="https://github.com/axios/axios/commit/fa6a55ef99235074d2c11d80a1064ef02850d598"><code>fa6a55e</code></a> chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (<a href="https://redirect.github.com/axios/axios/issues/11026">#11026</a>)</li> <li><a href="https://github.com/axios/axios/commit/40e7be8a78dd43caaeb2313cc4be3f8e714be91d"><code>40e7be8</code></a> docs: clarifies that request data is request-specific in axios (<a href="https://redirect.github.com/axios/axios/issues/11025">#11025</a>)</li> <li><a href="https://github.com/axios/axios/commit/a446b39b19c8b570214a4158520c5ddd5b020366"><code>a446b39</code></a> fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...</li> <li><a href="https://github.com/axios/axios/commit/cf1306a42d97960b635c894c83658f2692e53585"><code>cf1306a</code></a> docs: add Deno to install instructions (<a href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>)</li> <li><a href="https://github.com/axios/axios/commit/b32880af48017457a1203ab2e63720902d3b71b3"><code>b32880a</code></a> fix: incorrect use of error (<a href="https://redirect.github.com/axios/axios/issues/11021">#11021</a>)</li> <li><a href="https://github.com/axios/axios/commit/1792eda11aff8fe0f8c8a6e5ae6ff305740a6460"><code>1792eda</code></a> fix: ensure maxBodyLength is explicitly passed to follow-redirects (<a href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li> <li><a href="https://github.com/axios/axios/commit/30499d6af0961ec38619792013a534d1933b08a9"><code>30499d6</code></a> fix: various runtime crashes and type definition mismatches (<a href="https://redirect.github.com/axios/axios/issues/10959">#10959</a>)</li> <li><a href="https://github.com/axios/axios/commit/20ce9c412ebd88823d1a4a47000cb133a8f79440"><code>20ce9c4</code></a> fix(http): defer env proxy handling to Node (<a href="https://redirect.github.com/axios/axios/issues/10942">#10942</a>)</li> <li><a href="https://github.com/axios/axios/commit/e64bcf9c5af231d6f37d8389b1e57ded314fff86"><code>e64bcf9</code></a> chore(deps): merge branch 'v1.x' into tests/module/cjs (<a href="https://redirect.github.com/axios/axios/issues/11014">#11014</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/mcp-toolbox/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dishaprakash <57954147+dishaprakash@users.noreply.github.com>	2026-07-23 18:23:24 +05:30
dependabot[bot]	baaf6ecddb	chore(deps): bump axios from 1.17.0 to 1.18.1 in /docs/en/documentation/configuration/pre-post-processing/js/adk (#3664 ) Bumps [axios](https://github.com/axios/axios) from 1.17.0 to 1.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.18.1 — June 21, 2026</h2> <p>This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.</p> <h2>🐛 Bug Fixes</h2> <ul> <li>AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (<a href="https://redirect.github.com/axios/axios/issues/10913">#10913</a>)</li> <li>Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (<a href="https://redirect.github.com/axios/axios/issues/10917">#10917</a>, <a href="https://redirect.github.com/axios/axios/issues/10930">#10930</a>, <a href="https://redirect.github.com/axios/axios/issues/10942">#10942</a>, <a href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li> <li>Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (<a href="https://redirect.github.com/axios/axios/issues/10959">#10959</a>, <a href="https://redirect.github.com/axios/axios/issues/11021">#11021</a>)</li> <li>AxiosURLSearchParams: Switched the encoder callback to an arrow function so <code>encoder.call(this)</code> receives the <code>AxiosURLSearchParams</code> instance correctly. (<a href="https://redirect.github.com/axios/axios/issues/11019">#11019</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p>Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (<a href="https://redirect.github.com/axios/axios/issues/11007">#11007</a>, <a href="https://redirect.github.com/axios/axios/issues/11010">#11010</a>, <a href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>, <a href="https://redirect.github.com/axios/axios/issues/11025">#11025</a>)</p> </li> <li> <p>Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (<a href="https://redirect.github.com/axios/axios/issues/11011">#11011</a>, <a href="https://redirect.github.com/axios/axios/issues/11012">#11012</a>, <a href="https://redirect.github.com/axios/axios/issues/11013">#11013</a>, <a href="https://redirect.github.com/axios/axios/issues/11014">#11014</a>, <a href="https://redirect.github.com/axios/axios/issues/11015">#11015</a>, <a href="https://redirect.github.com/axios/axios/issues/11016">#11016</a>, <a href="https://redirect.github.com/axios/axios/issues/11017">#11017</a>, <a href="https://redirect.github.com/axios/axios/issues/11026">#11026</a>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><a href="https://github.com/webdevelopersrinu"><code>@webdevelopersrinu</code></a> (<a href="https://redirect.github.com/axios/axios/issues/10913">#10913</a>)</li> <li><a href="https://github.com/sijie-Z"><code>@sijie-Z</code></a> (<a href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li> <li><a href="https://github.com/bartlomieju"><code>@bartlomieju</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>)</li> <li><a href="https://github.com/JSap0914"><code>@JSap0914</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11019">#11019</a>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.18.0...v1.18.1">Full Changelog</a></p> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/a209bfb1e5dcbce3cecbf4bd955339d006358887"><code>a209bfb</code></a> chore(release): prepare release 1.18.1 (<a href="https://redirect.github.com/axios/axios/issues/11027">#11027</a>)</li> <li><a href="https://github.com/axios/axios/commit/fa6a55ef99235074d2c11d80a1064ef02850d598"><code>fa6a55e</code></a> chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (<a href="https://redirect.github.com/axios/axios/issues/11026">#11026</a>)</li> <li><a href="https://github.com/axios/axios/commit/40e7be8a78dd43caaeb2313cc4be3f8e714be91d"><code>40e7be8</code></a> docs: clarifies that request data is request-specific in axios (<a href="https://redirect.github.com/axios/axios/issues/11025">#11025</a>)</li> <li><a href="https://github.com/axios/axios/commit/a446b39b19c8b570214a4158520c5ddd5b020366"><code>a446b39</code></a> fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...</li> <li><a href="https://github.com/axios/axios/commit/cf1306a42d97960b635c894c83658f2692e53585"><code>cf1306a</code></a> docs: add Deno to install instructions (<a href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>)</li> <li><a href="https://github.com/axios/axios/commit/b32880af48017457a1203ab2e63720902d3b71b3"><code>b32880a</code></a> fix: incorrect use of error (<a href="https://redirect.github.com/axios/axios/issues/11021">#11021</a>)</li> <li><a href="https://github.com/axios/axios/commit/1792eda11aff8fe0f8c8a6e5ae6ff305740a6460"><code>1792eda</code></a> fix: ensure maxBodyLength is explicitly passed to follow-redirects (<a href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li> <li><a href="https://github.com/axios/axios/commit/30499d6af0961ec38619792013a534d1933b08a9"><code>30499d6</code></a> fix: various runtime crashes and type definition mismatches (<a href="https://redirect.github.com/axios/axios/issues/10959">#10959</a>)</li> <li><a href="https://github.com/axios/axios/commit/20ce9c412ebd88823d1a4a47000cb133a8f79440"><code>20ce9c4</code></a> fix(http): defer env proxy handling to Node (<a href="https://redirect.github.com/axios/axios/issues/10942">#10942</a>)</li> <li><a href="https://github.com/axios/axios/commit/e64bcf9c5af231d6f37d8389b1e57ded314fff86"><code>e64bcf9</code></a> chore(deps): merge branch 'v1.x' into tests/module/cjs (<a href="https://redirect.github.com/axios/axios/issues/11014">#11014</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/mcp-toolbox/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dishaprakash <57954147+dishaprakash@users.noreply.github.com>	2026-07-23 16:01:52 +05:30
Yuan Teoh	2a5182c7fe	chore: add metadata to result (#3677 ) Added change regarding to this PR: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3002/changes Per-response protocol fields: Servers SHOULD include the following `io.modelcontextprotocol/*` field in every result's `_meta`, unless specifically configured not to do so, to identify themselves without relying on any prior connection state: \| Key \| Type \| Required \| Description \| \| ------------------------------------ \| ---------------- \| -------- \| ----------------------- \| \| `io.modelcontextprotocol/serverInfo` \| `Implementation` \| No \| Server name and version \|	2026-07-23 04:34:06 +00:00
Anas Khan	08a6c86be0	docs(tool/mysql-list-active-queries): correct default limit to 100 (#3600 ) ## Description The documentation for the `mysql-list-active-queries` tool states that the `limit` parameter defaults to `10`, in two places: - the parameter list in the tool page prose, and - the example tool `description`, which is the text served to the LLM. The tool has registered `limit` with a default of `100` since it was introduced, and that value is passed straight into the SQL `LIMIT` clause. So when `limit` is omitted the tool returns up to 100 rows, not 10. The docs have understated the default since the tool was added. This is a docs-only correction that changes both stale `10` mentions to `100` to match the code. No behavior changes. Source of truth: `internal/tools/mysql/mysqllistactivequeries/mysqllistactivequeries.go` registers `parameters.NewIntParameter("limit", ..., parameters.WithIntDefault(100))` and passes `limit` into the `LIMIT ?` of both the MySQL and Cloud SQL statements. ## PR Checklist - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/mcp-toolbox/blob/main/CONTRIBUTING.md) - [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/mcp-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [x] Ensure the tests and linter pass - [x] Code coverage does not decrease (if any source code was changed) - N/A, docs-only, no source changed - [x] Appropriate docs were updated (if necessary) - this PR is the docs update - [x] Make sure to add `!` if this involve a breaking change - N/A, not a breaking change Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>	2026-07-22 20:47:00 +00:00
Anas Khan	a0f36f42c3	fix(source/http): block CGNAT 100.64.0.0/10 in default SSRF guard (#3625 ) The default SSRF guard in the HTTP source (`SSRFGuard.IsIPBlocked`) decides whether a resolved destination IP is allowed using `!ip.IsGlobalUnicast() \|\| ip.IsPrivate()`. Neither predicate covers the RFC 6598 shared address space `100.64.0.0/10`: those addresses are global-unicast and are not classified as private by `net.IP.IsPrivate` (which only knows RFC 1918 and IPv6 ULA). So with SSRF protection on (`allowPrivateNetworks: false`, the default), a tool request, or a redirect, whose target host resolves into `100.64.0.0/10` was allowed through. That range is not internet-routable (RFC 6598 carrier-grade NAT / shared address space) and is commonly used by cloud providers and Kubernetes CNIs for internal node and Pod networking, so it is a real internal-reachability target and a standard SSRF-denylist entry. The docs already state the guard blocks "private IP ranges, loopback ranges, and link-local ranges (e.g. AWS/GCP metadata service at `169.254.169.254`)", so blocking CGNAT by default fits the stated contract rather than expanding it. Impact: with the default guard, an LLM/agent-controlled tool parameter that steers the destination host (directly or via an HTTP redirect) into `100.64.0.0/10` could reach internal services on cloud/Kubernetes node and Pod networks. `IsIPBlocked` is the single enforcement point, reached from both the dial-time `Control` hook and `CheckRedirect`, so the gap applied to every HTTP-tool request. Solution: - Add a package-level `cgnatRange` for `100.64.0.0/10`, parsed once via a small `mustParseCIDR` helper (matching the file's existing panic-on-bad-literal style). - Extend the single default-strict predicate in `IsIPBlocked` with `\|\| cgnatRange.Contains(ip)`. - Precedence is preserved: the `allowedIpRanges` whitelist is still checked first (an operator can opt a CGNAT range back in), and `allowPrivateNetworks: true` still bypasses the whole default block. - Extend `TestSSRFGuard` with range, boundary (just-below / just-above the /10), `allowPrivateNetworks` bypass, and `allowedIpRanges` override cases. - Update the HTTP source doc bullet to mention the range. Scope note: this deliberately covers only CGNAT (`100.64.0.0/10`). The same predicate also does not block RFC 6890 `192.0.0.0/24`; that is left out to keep the change surgical and the claim tight, and can be a follow-up if maintainers want it. ## PR Checklist - [x] Make sure you reviewed CONTRIBUTING.md - [ ] Make sure to open an issue as a bug/issue before writing your code! (No issue opened yet - this is a small, self-contained security fix. See the Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>	2026-07-22 19:23:26 +00:00
Anubhav Dhawan	6bf63a091f	docs: add Python SDK usage examples for URL parameter binding (#3644 ) ## Overview This PR updages docs for the URL Parameter Binding feature by showing how it can be utilized through the Python SDK clients, ensuring a smoother UX. ## Changes * Added a new "Using with MCP Toolbox Client SDKs" section. * This includes concrete code snippets demonstrating how to append query parameters to the connection string when initializing a `ToolboxClient`. * Added a dedicated section linking to the URL Parameter Binding page to improve feature discoverability from the main Tools configuration index. > [!NOTE] > Depends on SDK updates in https://github.com/googleapis/mcp-toolbox-sdk-python/pull/717.	2026-07-22 11:26:20 +05:30

1 2 3 4 5 ...

2146 Commits