chore(deps): bump the minor-and-patch group with 7 updates, adapted

Merged
GL
2d ago
+798-440

Supersedes #398 (Dependabot: bump the minor-and-patch group with 7 updates). It keeps the Dependabot commit and adds the changes CI needs to pass. All 7 updates stay in the group, and no unrelated package is pinned or overridden.

Why CI failed on #398

  • Build and typecheck: tsdown 0.23 removed dts.tsgo and dts.resolve. tsdown.config.ts then failed type checking (TS2769), and the build crashed with Cannot create property 'moduleUrl' on boolean 'true'.
  • Tests stalled: @hono/mcp 0.3.2 answers an MCP notification with a 202 whose body is JSON null. The MCP SDK client then awaits response.body?.cancel(). Under MSW that cancel never settles, so every test that connects to the mock MCP server hung. The real StackOne endpoint, and the spec, send a 202 with no body.
  • Property tests: @fast-check/vitest 0.5 needs vitest ^4.1.0 (it imports TestRunner), and the catalog allowed 4.0.x.

Fix

  • tsdown.config.ts: dts.resolve moves to deps.dts.alwaysBundle, keeping the same list. tsgo is dropped, so .d.ts files come from tsc. @typescript/native-preview is not installed, and the tsgo generator in tsdown 0.23 needs a TypeScript 7.1 beta. exports.inlinedDependencies: false stops the build from writing a new inlinedDependencies field into package.json.
  • mocks/mcp-server.ts: a 202 from the transport is returned as an empty 202, matching the real endpoint. Status, routing and tool call recording are unchanged.
  • pnpm-workspace.yaml: the vitest and @vitest/coverage-v8 catalog floors go to ^4.1.0. The prod @modelcontextprotocol/sdk range stays ^1.24.3. The earlier WIP commit on this branch raised it to ^1.29.0, and that is reverted because consumers do not need it. The lockfile resolves 1.32.2, which satisfies the @hono/mcp dev peer.
  • package.json: tsdown now writes publishConfig.exports with import before require. Only the key order changes.
  • src/tool-optional-ai.test.ts: tsdown 0.23 roots the unbundled output at src, so dist/src/tool.* is now dist/tool.*. The test still pointed at the old paths, so it silently skipped both optional ai peer checks. It now finds the build and runs them.

Published package (before vs after pnpm build)

  • Runtime exports are identical in ESM and CJS: BaseTool, StackOneAPIError, StackOneError, StackOneTool, StackOneToolSet, ToolArgumentsError, ToolSetConfigError, ToolSetError, ToolSetLoadError, Tools.
  • exports still exposes only ., which points at dist/index.{mjs,cjs} and dist/index.d.{mts,cts}. Internal modules move from dist/src/* to dist/*. Deep paths were never exported.
  • The .d.ts files are equivalent once export style is normalized. The bundled type packages under dist/node_modules are the same set as the published 3.1.0 (ai, @ai-sdk/provider, provider-utils, @standard-schema/spec, type-fest, zod). publint is clean.
  • One consumer-facing change comes from the Dependabot bump itself: the optional @anthropic-ai/sdk peer range goes from ^0.72.1 to ^0.137.0.

Local checks (node 24.22.1, pnpm 11.17.0)

  • pnpm build: OK, publint found no issues.
  • pnpm test: 47 files passed. 1323 tests passed, plus 4 typecheck placeholders that main also skips. No type errors. The optional peer and package-exports tests now run instead of skipping.
  • pnpm lint (oxfmt, knip, oxlint type-aware): clean. The knip hints are the same as on main.
  • pnpm pack: OK.
  • Known and existing before this change: hono-rate-limiter wants hono ^4.10.8, and the dev catalog has 4.10.7.

Reviewed with the StackOne code review skill (security, correctness, quality, dependencies; all clean) and a Codex review. Codex found the stale dist path in the optional peer test, which is fixed here.

Requested by guillaume@stackone.com via the s2d2 Security Autopilot workflow (run sa-2026-11-06-35b8d066).

šŸ¤– Generated with Claude Code

Summary by cubic

Applies the Dependabot minor-and-patch group bump (7 packages) and adapts the build and test setup so CI passes on the new versions. The published package's runtime exports, types, and bundled type packages are unchanged; the only consumer-facing change is the optional @anthropic-ai/sdk peer range, now >=0.72.1 <2.0.0.

Adaptations for the new versions

  • Moved the type-bundling list from dts.resolve to deps.dts.alwaysBundle and set inlinedDependencies: false so the published package.json keeps its shape.
  • Dropped the tsgo .d.ts generator (needs TypeScript 7.1 beta); types now come from tsc.
  • Mock MCP server now returns an empty 202 for accepted notifications because @hono/mcp 0.3.2 sends a JSON null body whose cancel never settles under MSW.
  • Raised the vitest and @vitest/coverage-v8 catalog floors to ^4.1.0, required by @fast-check/vitest 0.5.
  • Kept the prod @modelcontextprotocol/sdk range at ^1.24.3; the lockfile resolves 1.32.2, which satisfies @hono/mcp 0.3.2's ^1.29.0 peer.
  • Pointed the optional AI peer test at dist/tool.*; tsdown 0.23 roots unbundled output at src, so the old dist/src/tool.* paths silently skipped those checks.
  • Widened the @anthropic-ai/sdk peer range from ^0.137.0 so consumers on older or 1.x SDK versions aren't cut off; only the structurally stable Tool type is imported.
  • Bumped the dev hono floor to ^4.13.16 so the mock server and the MCP SDK share a single version, fixing the 5 medium CVEs in hono 4.13.14 and clearing the hono-rate-limiter peer warning.