Skip to content

fix(t5): Align Zod and MCP SDK versions (F20, F21) - #6

Merged
kyalabs merged 1 commit into
mainfrom
fix/mcpduro-t5-deps
Mar 6, 2026
Merged

fix(t5): Align Zod and MCP SDK versions (F20, F21)#6
kyalabs merged 1 commit into
mainfrom
fix/mcpduro-t5-deps

Conversation

@kyalabs

@kyalabs kyalabs commented Mar 6, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • F20: Zod range widened from ^4.3.6 to ^3.24.0 || ^4.0.0 — matches mcp-server, improves npm deduplication for Zod 3.x consumers
  • F21: MCP SDK minimum pinned from ^1.0.0 to ^1.27.1 — ensures required protocol features are present
  • Version bump 0.7.4 → 0.7.5

Test plan

  • npm install resolves without errors
  • npm ls zod4.3.6 (same as mcp-server)
  • npm ls @modelcontextprotocol/sdk1.27.1 (same as mcp-server)
  • npm run build passes
  • npm test passes (24/24)
  • Verify package.json dep ranges match mcp-server exactly

Refs

MCPDuro_Mar6 Tier 5

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Released version 0.7.5
    • Updated Model Context Protocol SDK minimum version to ^1.27.1
    • Expanded Zod schema validation library support to include version 3.24.0 alongside version 4.x series, improving dependency resolution flexibility

- F20: Zod range widened ^4.3.6 → ^3.24.0 || ^4.0.0 (npm dedup for Zod 3.x consumers)
- F21: MCP SDK pinned ^1.0.0 → ^1.27.1 (ensures required protocol features)
- Version bump 0.7.4 → 0.7.5

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Mar 6, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4bb7334b-7545-4de9-8fe5-1d5ec007fb58

📥 Commits

Reviewing files that changed from the base of the PR and between e4e8ad7 and 6cdd799.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (4)
  • CHANGELOG.md
  • package.json
  • server.json
  • src/index.ts

📝 Walkthrough

Walkthrough

This release bumps the package version from 0.7.5 to 0.7.5 and updates dependency constraints. The MCP SDK minimum is pinned to ^1.27.1, and Zod range is widened to ^3.24.0 || ^4.0.0 for improved npm deduplication.

Changes

Cohort / File(s) Summary
Version Bumps
package.json, server.json, src/index.ts
Updated version identifier from 0.7.4 to 0.7.5 across manifest and source files.
Dependency Constraints
package.json
Updated @modelcontextprotocol/sdk from ^1.0.0 to ^1.27.1 and widened Zod range from ^4.3.6 to ^3.24.0 || ^4.0.0 for alignment and deduplication.
Release Documentation
CHANGELOG.md
Added version 0.7.5 entry (2026-03-06) documenting dependency alignment changes under Tier 5.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

Poem

🐰 A hop and a skip, we bump the release,
Zod's range now wider, npm at peace,
Dependencies pinned with precision and care,
Version 0.7.5 floats through the air! ✨

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly describes the main change: aligning Zod and MCP SDK versions for Tier 5 dependency alignment, with specific feature references F20 and F21 that match the changelog entries.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/mcpduro-t5-deps

Comment @coderabbitai help to get the list of available commands and usage tips.

@kyalabs
kyalabs merged commit 82a1270 into main Mar 6, 2026
1 check passed
@kyalabs
kyalabs deleted the fix/mcpduro-t5-deps branch March 6, 2026 23:14
kyalabs added a commit that referenced this pull request Mar 25, 2026
- Filter case-variant kya-token headers before spreading in webFetch
  so agents can't override the server-injected Kya-Token (Badge #6)
- Update lastEnrolledMerchant on cache hit in getCachedBadgeToken
  so no-arg getHeaders() returns the correct merchant context (Badge #11)

178/178 tests passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kyalabs added a commit that referenced this pull request Mar 26, 2026
* refactor: extract isPublicOrigin() to shared url-safety module

SSRF protection was defined locally in ucp-manifest.ts. Extract to
src/lib/url-safety.ts so kya_web_fetch and future outbound fetch
tools can reuse it. Zero functional change — import replaces inline.

Adds 16 tests covering RFC1918, localhost, IPv6 private, link-local,
AWS metadata (169.254.x), and malformed URL cases.

Part of: KYA-55

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add kya_getHeaders tool for browser automation identity

Returns { headers: { "Kya-Token": token } } for agents using
Playwright (setExtraHTTPHeaders) or Chrome extensions (document.cookie).
Returns NO_IDENTITY error when no identity established.

Part of: KYA-55 (Path 2/2.5 identity delivery)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add kya_web_fetch tool with auto-declare and SSRF protection

Primary identity delivery path. Wraps fetch with:
- Kya-Token header auto-injection
- Auto-declare (browse_declared event, fire-and-forget)
- SSRF protection via isPublicOrigin()
- HTTPS-only, 5MB body cap, 30s timeout
- Manual redirects (prevents token leak to redirect targets)
- Method allowlist: GET, HEAD, OPTIONS
- Response header filtering (strips set-cookie)

29 tests covering identity, URL validation, SSRF, methods, fetch
behavior, truncation, timeouts, auto-declare, and header override
prevention.

Part of: KYA-55 (Path 1 identity delivery)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: register new tools + deprecate legacy reporting

Register kya_web_fetch and kya_getHeaders in index.ts.
Deprecate kya_reportBadgeOutcome and kya_reportBadgeNotPresented
to no-ops — outcomes tracked server-side via verify endpoint,
not-presented event no longer scored. Both log once-per-session
stderr warning. Remove unused imports.

Update kya_reportBadgePresented description to stop referencing
the now-deprecated kya_reportBadgeOutcome.

Part of: KYA-55

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: bump to v2.5.0 + CHANGELOG for identity delivery

Version 2.4.0 → 2.5.0 (minor: new tools, deprecations, no breaking changes).
CHANGELOG documents kya_web_fetch, kya_getHeaders, deprecations.
.gitignore adds .env patterns.

Part of: KYA-55

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: credential bridge — inject kya_* badge token, not consent key (KYA-98)

The #1 E2E blocker. getHeaders() and webFetch() were injecting the
consent key (pk_* / OAuth token) as Kya-Token header. The verify
endpoint expects kya_* opaque tokens from /api/badge/enroll.

Fix:
- New module badge-token.ts: per-merchant badge token cache + enroll API
- getAgentIdentity: calls enroll after identity established (fire-and-forget)
- webFetch: looks up cached badge token by merchant, enrolls on-the-fly if needed
- getHeaders: reads from badge token cache (last enrolled merchant)

Also updates NEXT_STEP_TEXT to reference 2.0 tools (KYA-105).

178 tests passing (10 new in badge-token.test.ts).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: send consent key as Bearer auth on enroll call (KYA-106 compat)

Enroll endpoint now requires auth. badge-token.ts must send the
consent key as Authorization: Bearer header when calling enroll.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address CodeRabbit review findings on KYA-55

- Filter case-variant kya-token headers before spreading in webFetch
  so agents can't override the server-injected Kya-Token (Badge #6)
- Update lastEnrolledMerchant on cache hit in getCachedBadgeToken
  so no-arg getHeaders() returns the correct merchant context (Badge #11)

178/178 tests passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(deps): patch picomatch CVEs (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p)

npm audit fix — upgrades picomatch transitive dep to patched version.
ReDoS via extglob quantifiers + method injection in POSIX character classes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Marty CPO <james@kyalabs.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant