Repository navigation
chore(deps): upgrade the MCP TypeScript SDK to 2.4.0 #2784
Description
A new MCP TypeScript SDK release is out. What is installed on v2/main is behind what the npm registry publishes.
| Package | Declared | Installed on v2/main |
Latest on npm | Behind |
|---|---|---|---|---|
@modelcontextprotocol/client |
2.3.1 | 2.3.1 | 2.4.0 | yes |
@modelcontextprotocol/core |
2.3.1 | 2.3.1 | 2.4.0 | yes |
@modelcontextprotocol/server |
2.3.1 | 2.3.1 | 2.4.0 | yes |
@modelcontextprotocol/server-legacy |
2.3.1 | 2.3.1 | 2.4.0 | yes |
Release notes: https://github.com/modelcontextprotocol/typescript-sdk/releases
Why this is an issue and not a PR
Filed by the nightly SDK watch (#1063), the third of this repo's issue-filing sweeps alongside the monthly dependency refresh (#2229) and the daily Dependabot alert sweep (#2233). None of them opens a PR: a bot-authored PR carries no Closes #N and no board card, so the work would be invisible to the board. A maintainer picks this up and opens a normal PR against v2/main.
Upgrade checklist
- Bump the version(s) in the repo-root
package.json— every runtime dependencycore/imports is declared in the repo-rootpackage.jsonand nowhere else (Dependency placement). The fourtypescript-sdkpackages are pinned exactly, so they move together. -
npm installat the root, and commit the refreshed lockfile. - Re-check the bundler
externallists (clients/{cli,mcpdo,tui}/tsup.config.ts,clients/web/tsup.runner.config.ts) if the release adds or renames an entry point;npm run verify:bundle-externalsenforces this against the built output. -
npm run format, thennpm run local:gate.
An automated review of what actually changed upstream — and which parts of this app it touches — is posted as a comment below.
A later run of this sweep will not refile this issue. A further SDK release files its own issue and leaves a supersession note here rather than editing this one.
Activity
cliffhall commentedon Oct 25, 2026
Triage: Priority Medium (total 7)
v2.13.0)Board: #28, Status
Todo— the issue arrived milestoned, so the approval was already recorded and only the card was missing.fix(core): reject x-mcp-header on number params, matching SDK 2.4.0 (#…
cliffhall commentedon Oct 25, 2026
Shipped in #2799 (merge
2866d0b0): the four typescript-sdk packages are now at 2.4.0, andcore/json/xMcpHeader.tsrejectsnumber-typedx-mcp-headerparams the way the SDK does. Follow-ups for the new SDK features: #2804 (Skills client) and #2805 (scopeForRefresh).