chore(deps): bump the npm-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the npm-minor-patch group with 4 updates in the / directory: @modelcontextprotocol/sdk, pg, picomatch and ws.

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in modelcontextprotocol/typescript-sdk#1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in modelcontextprotocol/typescript-sdk#1839
• Add end-to-end test suite by @​felixweinberger in modelcontextprotocol/typescript-sdk#2167
• v1 stdio buffer limit by @​KKonstantinov in modelcontextprotocol/typescript-sdk#2239
• fix: support Zod 3.25 method literals by @​mattzcarey in modelcontextprotocol/typescript-sdk#2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in modelcontextprotocol/typescript-sdk#2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in modelcontextprotocol/typescript-sdk#2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2547
• chore: bump version to 1.30.0 by @​felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

• @​mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503
• @​arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

• 2d889f2 chore: bump version to 1.30.0 (#2563)
• e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
• bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
• 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
• 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
• 369513d fix: support Zod 3.25 method literals (#2368)
• e7ee57c v1 stdio buffer limit (#2239)
• c36e1ef Add end-to-end test suite (#2167)
• bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
• 9edbab7 fix(server): prioritize zod issues and format them (#1503)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.

Updates pg from 8.21.0 to 8.22.0

Changelog

Sourced from pg's changelog.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

Commits

• b617619 Publish
• d80b261 Update docs & changelog
• 835fb83 Fix error handling for exceptions on values parsing. (#3574)
• f49ab4a fix: correct spelling mistakes across codebase (#3692)
• d7175a4 Expand CI matrix of PG versions and add direct SSL test (#3693)
• 882fc30 Add support for sslnegotiation=direct (PostgreSQL 17) (#3688)
• See full diff in compare view

Updates picomatch from 4.0.4 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

• fix: preserve all branches when rewriting risky repeated extglobs by @​MerlijnW70 in micromatch/picomatch#182
• fix: honor the windows option when matching basenames by @​MerlijnW70 in micromatch/picomatch#183

New Contributors

• @​MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

Commits

• 4f41a8e 4.0.5
• 02cfc1b Update .verb.md and run verb to generate README documentation
• cc52ff6 Only run the upload code coverage step for 1 matrix permutation
• 6d426d7 Allow workflow to continue if the code coverage step to fails
• a00b954 Merge branch 'codeql-coverage'
• 9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
• 648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
• 70e6485 Configure code coverage upload for CodeQL
• ab8bc4d fix: honor the windows option when matching basenames
• 6289307 fix: preserve all branches when rewriting risky repeated extglobs
• Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions