chore(deps): update dependency @brightdata/mcp to v2.11.1 by renovate[bot] · Pull Request #469 · stacklok/dockyard

renovate · 2026-04-17T18:14:37Z

This PR contains the following updates:

Package	Change	Age	Confidence
@brightdata/mcp	`2.9.0` → `2.11.1`

Release Notes

brightdata/brightdata-mcp (@brightdata/mcp)

`v2.11.1`

Compare Source

Fixed

Fixed compatibility with updated Playwright API: replaced deprecated page._snapshotForAI() with page.ariaSnapshot({ mode: 'ai' }), restoring correct functionality of scraping_browser_snapshot and all ref-based browser automation tools

`v2.11.0`

Compare Source

Added

Added reddit_comments tool to collect Reddit post comments

`v2.10.0`

Compare Source

Added

search_dataset tool to search supported datasets by a filter and get matching records back directly via the fast search API (PR #142)
list_dataset_fields tool to discover a dataset's filterable fields (name, type, description) before building a filter (PR #142)

v2.9.3

New code tool group - your coding agent's companion
- web_data_npm_package - look up any npm package by name and get back
  structured metadata: latest version, README, dependencies, and more
  (e.g. @brightdata/sdk, express, fastify)
- web_data_pypi_package - look up any PyPI package by name and get back
  structured metadata: latest version, README, dependencies, and more
  (e.g. langchain-brightdata, requests, numpy)
- Enable with GROUPS="code" - works with Claude Code, Cursor, Windsurf,
  and any MCP-powered coding agent
Added code group row to the tool groups table in README
Added coding agent configuration example in README

Why this matters

Coding agents constantly need to answer questions like "what's the latest
version of X?" or "what does this package do?". Until now that meant
scraping registry pages or relying on stale training data. The code group
gives agents a single, reliable tool to query npm and PyPI directly —
structured data, no scraping, no blocking, always up to date.

`v2.9.2`

Compare Source

`v2.9.1`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-advanced-security · 2026-04-17T18:20:05Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-actions · 2026-04-17T18:20:38Z

🔒 MCP Security Scan Results

⚠️ brightdata-mcp

Status: Warning
Message: Scan failed to produce output (insecure_ignore is enabled)

Summary: Scanned 1 MCP server(s), all passed security checks. ✅

rdimitrov · 2026-04-21T15:28:07Z

@renovatebot rebase

JAORMX · 2026-04-27T12:47:41Z

Triage: build-containers blocked by genuine upstream CVEs

Local Grype scan (DB 2026-04-27) of the 2.9.5 image surfaces these HIGH findings (severity-cutoff: high, only-fixed: true):

Package	Installed	GHSA	Severity	Fixed in
@modelcontextprotocol/sdk	1.21.2	GHSA-w48q-cv73-mx4w	High	1.24.0
@modelcontextprotocol/sdk	1.21.2	GHSA-8r9q-7v3j-jr4g	High	1.25.2
@modelcontextprotocol/sdk	1.21.2	GHSA-345p-7cg4-v4c7	High	1.26.0
picomatch	4.0.3	GHSA-c2c7-rcm5-vvqj	High	4.0.4

These are genuine upstream CVEs, not false positives. The fix requires @brightdata/mcp to bump its @modelcontextprotocol/sdk dep to ≥1.26.0 (and pull in updated transitive deps for picomatch).

Recommendation: Hold this bump until upstream brightdata-com/brightdata-mcp updates the MCP SDK pin.

…n spec.yaml Renovate version bumps fail the build-containers Grype gate when the bumped package pins or caps a transitive dependency to a vulnerable version. Add an optional dependency-override mechanism to the spec.yaml schema, plumbed into the generated Dockerfile. - npx: spec.overrides ([]{package, version, reason}) is injected as an npm "overrides" block in the generated package.json before the npm install step. - uvx: spec.constraints ([]{spec, reason}) is written to a uv overrides requirements file and passed to "uv tool install --overrides". Both injection points match the install step by content (not line number) so they stay robust to toolhive template formatting. Every entry requires a non-empty reason (validation fails otherwise) so the justification for circumventing an upstream pin is auditable in-repo. Verified end-to-end against the CI build + Grype recipe: - #469 @brightdata/mcp 2.9.5 + override @modelcontextprotocol/sdk 1.26.0: resolves to SDK 1.26.0, grype --fail-on high --only-fixed passes. - #527 mcp-clickhouse 0.3.0 + constraint fastmcp>=3.2.0: fastmcp 3.4.0, import mcp_clickhouse OK, grype passes. Refs #668 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…n spec.yaml (#669) * feat(dockhand): support transitive dependency overrides/constraints in spec.yaml Renovate version bumps fail the build-containers Grype gate when the bumped package pins or caps a transitive dependency to a vulnerable version. Add an optional dependency-override mechanism to the spec.yaml schema, plumbed into the generated Dockerfile. - npx: spec.overrides ([]{package, version, reason}) is injected as an npm "overrides" block in the generated package.json before the npm install step. - uvx: spec.constraints ([]{spec, reason}) is written to a uv overrides requirements file and passed to "uv tool install --overrides". Both injection points match the install step by content (not line number) so they stay robust to toolhive template formatting. Every entry requires a non-empty reason (validation fails otherwise) so the justification for circumventing an upstream pin is auditable in-repo. Verified end-to-end against the CI build + Grype recipe: - #469 @brightdata/mcp 2.9.5 + override @modelcontextprotocol/sdk 1.26.0: resolves to SDK 1.26.0, grype --fail-on high --only-fixed passes. - #527 mcp-clickhouse 0.3.0 + constraint fastmcp>=3.2.0: fastmcp 3.4.0, import mcp_clickhouse OK, grype passes. Refs #668 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(dockhand): harden dependency-override injection against template drift The injection anchors are matched against toolhive's generated Dockerfile, but the tests only exercised hand-written samples that mirror it, so drift in the real template would pass tests and silently ship an image with no overrides applied. - Match the uvx install step on the bare "uv tool install" verb instead of requiring the quoted package spec to follow immediately. toolhive's template conditionally emits its own flags in between (RuntimeConfig .BuildWith renders as "--with '<spec>'"), which the old anchor missed entirely. - Parse the package.json payload toolhive emits and add the overrides key to it, rather than rebuilding the file from hardcoded name/version constants. Any other field toolhive puts there is now preserved instead of silently dropped. - Add tests that inject into Dockerfiles generated by the pinned toolhive version, covering the uvx step both with and without build-time constraints. These fail on anchor drift; they catch the --with case the previous anchor could not. * fix(mcp-scan): reapply uvx dependency overrides during the security scan The security scan runs the package directly rather than the built image, so it never saw the overrides injected into the Dockerfile and exercised a different dependency set than the one that ships. Pass spec.constraints through to the scanner as a uv overrides requirements file (uv takes a file, not inline specifiers), written to a temp file for the duration of the scan. npx spec.overrides are not reapplied: npm honors "overrides" only from a package.json it installs into, and the scan has no project directory. That is safe for the intended use case, since swapping a vulnerable but working dependency changes neither startup nor the tool surface being analyzed, but log a note so a future startup-affecting override does not fail confusingly. * fix(adb-mysql-mcp-server): constrain mcp to <2 to fix broken build adb-mysql-mcp-server depends on mcp[cli]>=1.8.0 with no upper bound. mcp 2.0.0 removed the mcp.server.fastmcp module this server imports at startup, breaking both the container build and the smoke test canary in build-containers.yml. This is also the first spec.yaml to exercise the override mechanism, so CI now actually covers it end to end rather than only unit tests. * fix(dockhand): quote override values interpolated into the Dockerfile Override values were interpolated into RUN lines inside unescaped single quotes. A PEP 508 requirement legitimately contains single quotes in an environment marker, so fastmcp>=3.2.0; python_version < '3.14' was written to the overrides file as fastmcp>=3.2.0; python_version < 3.14 which is no longer a valid marker. Anything following the quote also ran as shell at image build time, so a spec value was able to execute arbitrary commands during the build. The npm path had the same flaw via the echoed package.json payload. - Add shellSingleQuote and use it for both the uv override specs and the npm package.json payload, escaping embedded quotes as '\''. - Reject control characters in override/constraint values. Quoting makes shell metacharacters inert, but a newline would still terminate the RUN instruction, and none of these fields has a legitimate use for one. - Cover quoted markers, embedded quotes, and injection attempts. These execute the emitted line through a real shell and compare the file it writes, rather than assuming how the line parses. * test(dockhand): extract repeated literals to satisfy goconst The new test cases pushed "1.26.0" and "injection attempt" past goconst's occurrence threshold, failing CI lint. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Dan Barr <6922515+danbarr@users.noreply.github.com>

danbarr · 2026-08-05T20:22:47Z

This is unblocked and should be safe to merge as-is.

This bump was one of the three cases #668 was opened for. That mechanism landed in #669, and #833 applied it to brightdata-mcp on main: @modelcontextprotocol/sdk is overridden to 1.26.0, which clears the three high advisories that come with the pinned 1.21.2 (GHSA-w48q-cv73-mx4w, GHSA-8r9q-7v3j-jr4g, GHSA-345p-7cg4-v4c7).

The override survives this bump unchanged, because the pin does not move:

Version	Declares `@modelcontextprotocol/sdk`
2.9.0 (current on main)	`1.21.2`
2.11.1 (this PR)	`1.21.2`

So the override is still both correct and necessary at 2.11.1, and the Grype gate should pass once this is rebased on current main.

One thing to watch on future bumps: the override pins an exact version, so if a later release of @brightdata/mcp ever raises its own SDK dependency above 1.26.0, the override would silently hold it back. Worth re-checking the declared version whenever renovate moves this one.

renovate Bot added the dependencies label Apr 17, 2026

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from a5747b8 to f0ae7d1 Compare April 20, 2026 11:05

renovate Bot changed the title ~~chore(deps): update dependency @brightdata/mcp to v2.9.4~~ chore(deps): update dependency @brightdata/mcp to v2.9.5 Apr 20, 2026

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch 2 times, most recently from 3eddbeb to 674490c Compare April 21, 2026 08:19

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch 3 times, most recently from 9172b66 to 69e9ae5 Compare April 27, 2026 12:13

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from 48a090d to 3bad57a Compare April 30, 2026 12:33

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch 2 times, most recently from f64e5c5 to 7cc9963 Compare May 14, 2026 17:57

This was referenced Jun 3, 2026

feat(dockhand): support transitive dependency overrides/constraints in spec.yaml #668

Closed

feat(dockhand): support transitive dependency overrides/constraints in spec.yaml #669

Merged

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from 7cc9963 to 36adf9a Compare June 4, 2026 09:14

renovate Bot changed the title ~~chore(deps): update dependency @brightdata/mcp to v2.9.5~~ chore(deps): update dependency @brightdata/mcp to v2.10.0 Jun 4, 2026

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from 36adf9a to 6a5f89a Compare June 14, 2026 09:53

renovate Bot changed the title ~~chore(deps): update dependency @brightdata/mcp to v2.10.0~~ chore(deps): update dependency @brightdata/mcp to v2.11.0 Jun 14, 2026

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch 3 times, most recently from a26436e to 3c61fb7 Compare July 3, 2026 10:14

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from 3c61fb7 to a7b032b Compare July 8, 2026 07:53

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from a7b032b to 14e0522 Compare July 17, 2026 14:10

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch 3 times, most recently from ac8031a to 8b29174 Compare July 27, 2026 12:54

renovate Bot changed the title ~~chore(deps): update dependency @brightdata/mcp to v2.11.0~~ chore(deps): update dependency @brightdata/mcp to v2.11.1 Jul 27, 2026

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from 8b29174 to 040045c Compare August 3, 2026 15:01

This was referenced Aug 5, 2026

Grype backlog: 10 published servers fail the vulnerability gate, several fixable via spec.constraints/overrides #830

Closed

feat(mcp-scan): apply npx dependency overrides during the security scan #831

Merged

chore(deps): update dependency @brightdata/mcp to v2.11.1

bbf5f46

renovate Bot force-pushed the renovate/brightdata-mcp-2.x branch from 040045c to bbf5f46 Compare August 5, 2026 20:16

danbarr approved these changes Aug 5, 2026

View reviewed changes

danbarr merged commit c165bc6 into main Aug 5, 2026
13 checks passed

danbarr deleted the renovate/brightdata-mcp-2.x branch August 5, 2026 20:25

danbarr mentioned this pull request Aug 5, 2026

Nothing re-evaluates dependency overrides when renovate bumps the parent package #837

Open

Navigation Menu

Uh oh!

chore(deps): update dependency @brightdata/mcp to v2.11.1 - #469

chore(deps): update dependency @brightdata/mcp to v2.11.1#469
danbarr merged 1 commit into
mainfrom
renovate/brightdata-mcp-2.x

renovate Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026 •

edited by toolhive-release-app Bot

Loading

Uh oh!

rdimitrov commented Apr 21, 2026

Uh oh!

JAORMX commented Apr 27, 2026

Uh oh!

danbarr commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

renovate Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Fixed

Added

Added

v2.9.3

Why this matters

Configuration

Uh oh!

github-advanced-security AI commented Apr 17, 2026

What Enabling Code Scanning Means:

Uh oh!

github-actions Bot commented Apr 17, 2026 • edited by toolhive-release-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 MCP Security Scan Results

⚠️ brightdata-mcp

Uh oh!

rdimitrov commented Apr 21, 2026

Uh oh!

JAORMX commented Apr 27, 2026

Triage: build-containers blocked by genuine upstream CVEs

Uh oh!

danbarr commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

renovate Bot commented Apr 17, 2026 •

edited

Loading

github-actions Bot commented Apr 17, 2026 •

edited by toolhive-release-app Bot

Loading