Skip to content

Bump the minor group across 4 directories with 5 updates#333

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-21a083ef2c
Open

Bump the minor group across 4 directories with 5 updates#333
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-21a083ef2c

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 2, 2026

Bumps the minor group with 5 updates in the / directory:

Package From To
gunshi 0.28.2 0.29.2
@modelcontextprotocol/sdk 1.20.2 1.27.1
agents 0.2.35 0.7.1
astro-og-canvas 0.7.2 0.10.1
starlight-llms-txt 0.6.1 0.7.0

Bumps the minor group with 1 update in the /packages/varlock directory: gunshi.
Bumps the minor group with 2 updates in the /packages/varlock-docs-mcp directory: @modelcontextprotocol/sdk and agents.
Bumps the minor group with 2 updates in the /packages/varlock-website directory: astro-og-canvas and starlight-llms-txt.

Updates gunshi from 0.28.2 to 0.29.2

Release notes

Sourced from gunshi's releases.

v0.29.2

Full Changelog: kazupon/gunshi@v0.29.1...v0.29.2

v0.29.1

Full Changelog: kazupon/gunshi@v0.29.0...v0.29.1

v0.29.0

What's Changed

🌟 Features

Full Changelog: kazupon/gunshi@v0.28.2...v0.29.0

Changelog

Sourced from gunshi's changelog.

v0.29.2 (2026-02-21T14:05:58Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.1...v0.29.2

v0.29.1 (2026-02-21T14:00:47Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.0...v0.29.1

v0.29.0 (2026-02-21T13:53:41Z)

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

Full Changelog: kazupon/gunshi@v0.28.2...v0.29.0

Commits

Updates @modelcontextprotocol/sdk from 1.20.2 to 1.27.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

v1.25.3

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.2...v1.25.3

... (truncated)

Commits
  • 4faa8c8 chore: bump version to 1.27.1 (#1581)
  • 09a85a8 fix: call onerror for silently swallowed transport errors (#1580)
  • e79d14a fix: prevent command injection in example URL opening (v1.x backport) (#1579)
  • 342ea39 docs: comprehensive feature documentation for SEP-1730 Tier 1 (#1548)
  • 2084a22 docs: add governance documentation for SEP-1730 (#1547)
  • f2d2145 feat: implement auth/pre-registration conformance scenario (#1545)
  • 8cbc658 chore: bump version for v1.27.0 (#1541)
  • 5c16ae3 [v1.x] feat(tasks): add streaming methods for elicitation and sampling (#1528)
  • 97ab379 feat: add url property to RequestInfo interface (#1353)
  • 825e9ab feat: backport discoverOAuthServerInfo() and discovery caching to v1.x (#1533)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by pcarleton, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates agents from 0.2.35 to 0.7.1

Release notes

Sourced from agents's releases.

agents@0.7.1

Patch Changes

  • #1046 2cde136 Thanks @​threepointone! - Add agent and name fields to observability events, identifying which agent class and instance emitted each event.

    New events: disconnect (WebSocket close), email:receive, email:reply, queue:create, and a new agents:email channel.

    Make _emit protected so subclasses can use it. Update AIChatAgent to use _emit so message/tool events carry agent identity.

agents@0.7.0

Minor Changes

  • #1024 e9ae070 Thanks @​threepointone! - Overhaul observability: diagnostics_channel, leaner events, error tracking.

    Breaking changes to agents/observability types

    • BaseEvent: Removed id and displayMessage fields. Events now contain only type, payload, and timestamp. The payload type is now strict — accessing undeclared fields is a type error. Narrow on event.type before accessing payload properties.
    • Observability.emit(): Removed the optional ctx second parameter.
    • AgentObservabilityEvent: Split combined union types so each event has its own discriminant (enables proper Extract-based type narrowing). Added new error event types.

    If you have a custom Observability implementation, update your emit signature to emit(event: ObservabilityEvent): void.

    diagnostics_channel replaces console.log

    The default genericObservability implementation no longer logs every event to the console. Instead, events are published to named diagnostics channels using the Node.js diagnostics_channel API. Publishing to a channel with no subscribers is a no-op, eliminating logspam.

    Seven named channels, one per event domain:

    • agents:state — state sync events
    • agents:rpc — RPC method calls and errors
    • agents:message — message request/response/clear/cancel/error + tool result/approval
    • agents:schedule — schedule and queue create/execute/cancel/retry/error events
    • agents:lifecycle — connection and destroy events
    • agents:workflow — workflow start/event/approve/reject/terminate/pause/resume/restart
    • agents:mcp — MCP client connect/authorize/discover events

    New error events

    Error events are now emitted at failure sites instead of (or alongside) console.error:

    • rpc:error — RPC method failures (includes method name and error message)
    • schedule:error — schedule callback failures after all retries exhausted
    • queue:error — queue callback failures after all retries exhausted

    Reduced boilerplate

    All 20+ inline emit blocks in the Agent class have been replaced with a private _emit() helper that auto-generates timestamps, reducing each call site from ~10 lines to 1.

    Typed subscribe helper

... (truncated)

Changelog

Sourced from agents's changelog.

0.7.1

Patch Changes

  • #1046 2cde136 Thanks @​threepointone! - Add agent and name fields to observability events, identifying which agent class and instance emitted each event.

    New events: disconnect (WebSocket close), email:receive, email:reply, queue:create, and a new agents:email channel.

    Make _emit protected so subclasses can use it. Update AIChatAgent to use _emit so message/tool events carry agent identity.

0.7.0

Minor Changes

  • #1024 e9ae070 Thanks @​threepointone! - Overhaul observability: diagnostics_channel, leaner events, error tracking.

    Breaking changes to agents/observability types

    • BaseEvent: Removed id and displayMessage fields. Events now contain only type, payload, and timestamp. The payload type is now strict — accessing undeclared fields is a type error. Narrow on event.type before accessing payload properties.
    • Observability.emit(): Removed the optional ctx second parameter.
    • AgentObservabilityEvent: Split combined union types so each event has its own discriminant (enables proper Extract-based type narrowing). Added new error event types.

    If you have a custom Observability implementation, update your emit signature to emit(event: ObservabilityEvent): void.

    diagnostics_channel replaces console.log

    The default genericObservability implementation no longer logs every event to the console. Instead, events are published to named diagnostics channels using the Node.js diagnostics_channel API. Publishing to a channel with no subscribers is a no-op, eliminating logspam.

    Seven named channels, one per event domain:

    • agents:state — state sync events
    • agents:rpc — RPC method calls and errors
    • agents:message — message request/response/clear/cancel/error + tool result/approval
    • agents:schedule — schedule and queue create/execute/cancel/retry/error events
    • agents:lifecycle — connection and destroy events
    • agents:workflow — workflow start/event/approve/reject/terminate/pause/resume/restart
    • agents:mcp — MCP client connect/authorize/discover events

    New error events

    Error events are now emitted at failure sites instead of (or alongside) console.error:

    • rpc:error — RPC method failures (includes method name and error message)
    • schedule:error — schedule callback failures after all retries exhausted
    • queue:error — queue callback failures after all retries exhausted

    Reduced boilerplate

    All 20+ inline emit blocks in the Agent class have been replaced with a private _emit() helper that auto-generates timestamps, reducing each call site from ~10 lines to 1.

    Typed subscribe helper

    A new subscribe() function is exported from agents/observability with full type narrowing per channel:

... (truncated)

Commits
  • 477d338 Version Packages (#1047)
  • 2cde136 Observability: include agent identity & events (#1046)
  • 64d9ad6 Version Packages (#995)
  • 766f20b docs: update ai-chat docs for post-0.6.0 changes (#1040)
  • 00d5a31 Reduce test noise: mock MCP connections and add ai-chat DO cleanup (#1037)
  • ec9a4b7 Reduce Durable Object test noise (#1036)
  • 24cf279 fix: cleaner tests, better error handling, and protocol improvements (#1035)
  • b29d8dd Add Agent.keepAliveWhile() and update AIChatAgent to use it (#1033)
  • c898308 feat: add Agent.keepAlive() to prevent idle eviction (#1029)
  • e9ae070 feat(observability): replace console.log with diagnostics_channel, add typed ...
  • Additional commits viewable in compare view

Updates astro-og-canvas from 0.7.2 to 0.10.1

Release notes

Sourced from astro-og-canvas's releases.

astro-og-canvas@0.10.1

Patch Changes

astro-og-canvas@0.10.0

Minor Changes

  • #119 151edd2 Thanks @​delucis! - Makes OGImageRoute() asynchronous.

    ⚠️ BREAKING CHANGE: You must now await the result of OGImageRoute():

    import { OGImageRoute } from 'astro-og-canvas';

export const { getStaticPaths, GET } = OGImageRoute({


export const { getStaticPaths, GET } = await OGImageRoute({

Patch Changes

  • #119 151edd2 Thanks @​delucis! - Fixes using the built-in getSlug() for OG images with format: "JPEG" or format: "WEBP"

astro-og-canvas@0.9.0

Minor Changes

  • #117 b94a123 Thanks @​delucis! - Adds type safety to OGImageRoute. The page parameter in getSlug() and getImageOptions() is now correctly inferred from the value passed to pages instead of being typed as any.

    OGImageRoute({
  pages: {
    example: {
      title: 'Example Page',
      description: 'Description of this page shown in smaller text',
    },
  },
  getImageOptions: (path, page) => {
    page;
    // ^? { title: string; description: string }
  },
});

    ⚠️ Potentially breaking change: If you are type checking your code base, you may see type errors if you are accessing page in getSlug() or getImageOptions() in a non-type-safe way and will need to either update that code or add some additional types.

  • #117 b94a123 Thanks @​delucis! - Exports OGImageOptions type

astro-og-canvas@0.8.0

Minor Changes

... (truncated)

Changelog

Sourced from astro-og-canvas's changelog.

0.10.1

Patch Changes

0.10.0

Minor Changes

  • #119 151edd2 Thanks @​delucis! - Makes OGImageRoute() asynchronous.

    ⚠️ BREAKING CHANGE: You must now await the result of OGImageRoute():

    import { OGImageRoute } from 'astro-og-canvas';

export const { getStaticPaths, GET } = OGImageRoute({


export const { getStaticPaths, GET } = await OGImageRoute({

Patch Changes

  • #119 151edd2 Thanks @​delucis! - Fixes using the built-in getSlug() for OG images with format: "JPEG" or format: "WEBP"

0.9.0

Minor Changes

  • #117 b94a123 Thanks @​delucis! - Adds type safety to OGImageRoute. The page parameter in getSlug() and getImageOptions() is now correctly inferred from the value passed to pages instead of being typed as any.

    OGImageRoute({
  pages: {
    example: {
      title: 'Example Page',
      description: 'Description of this page shown in smaller text',
    },
  },
  getImageOptions: (path, page) => {
    page;
    // ^? { title: string; description: string }
  },
});

    ⚠️ Potentially breaking change: If you are type checking your code base, you may see type errors if you are accessing page in getSlug() or getImageOptions() in a non-type-safe way and will need to either update that code or add some additional types.

  • #117 b94a123 Thanks @​delucis! - Exports OGImageOptions type

... (truncated)

Commits

Updates starlight-llms-txt from 0.6.1 to 0.7.0

Release notes

Sourced from starlight-llms-txt's releases.

starlight-llms-txt@0.7.0

Minor Changes

  • #43 1db4591 Thanks @​sanscontext! - Enforces llms.txt files to be prerendered at build time. Previously, sites using Astro’s output: server configuration would generate llms.txt files on-demand, which can be slow, and additionally was incompatible with the custom sets feature. This change means that llms.txt files are statically generated even for sites using output: server.

    ⚠️ Potentially breaking change: If you were relying on on-demand rendered llms.txt files, for example by using middleware to gate access, this may be a breaking change. Please share your use case to let us know if you need this.

Changelog

Sourced from starlight-llms-txt's changelog.

0.7.0

Minor Changes

  • #43 1db4591 Thanks @​sanscontext! - Enforces llms.txt files to be prerendered at build time. Previously, sites using Astro’s output: server configuration would generate llms.txt files on-demand, which can be slow, and additionally was incompatible with the custom sets feature. This change means that llms.txt files are statically generated even for sites using output: server.

    ⚠️ Potentially breaking change: If you were relying on on-demand rendered llms.txt files, for example by using middleware to gate access, this may be a breaking change. Please share your use case to let us know if you need this.

Commits

Updates gunshi from 0.28.2 to 0.29.2

Release notes

Sourced from gunshi's releases.

v0.29.2

Full Changelog: kazupon/gunshi@v0.29.1...v0.29.2

v0.29.1

Full Changelog: kazupon/gunshi@v0.29.0...v0.29.1

v0.29.0

What's Changed

🌟 Features

Full Changelog: kazupon/gunshi@v0.28.2...v0.29.0

Changelog

Sourced from gunshi's changelog.

v0.29.2 (2026-02-21T14:05:58Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.1...v0.29.2

v0.29.1 (2026-02-21T14:00:47Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.0...v0.29.1

v0.29.0 (2026-02-21T13:53:41Z)

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

Full Changelog: kazupon/gunshi@v0.28.2...v0.29.0

Commits

Updates @modelcontextprotocol/sdk from 1.20.2 to 1.27.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

v1.25.3

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.2...v1.25.3

... (truncated)

Commits
  • 4faa8c8 chore: bump version to 1.27.1 (#1581)
  • 09a85a8 fix: call onerror for silently swallowed transport errors (#1580)
  • e79d14a fix: prevent command injection in example URL opening (v1.x backport) (#1579)
  • 342ea39 docs: comprehensive feature documentation for SEP-1730 Tier 1 (#1548)
  • 2084a22 docs: add governance documentation for SEP-1730 (#1547)
  • f2d2145 feat: implement auth/pre-registration conformance scenario (#1545)
  • 8cbc658 chore: bump version for v1.27.0 (#1541)
  • 5c16ae3 [v1.x] feat(tasks): add streaming methods for elicitation and sampling (#1528)
  • 97ab379 feat: add url property to RequestInfo interface (#1353)
  • 825e9ab feat: backport discoverOAuthServerInfo() and discovery caching to v1.x (#1533)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by pcarleton, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates agents from 0.2.35 to 0.7.1

Release notes

Sourced from agents's releases.

agents@0.7.1

Patch Changes

  • #1046 2cde136 Thanks @​threepointone! - Add agent and name fields to observability events, identifying which agent class and instance emitted each event.

    New events: disconnect (WebSocket close), email:receive, email:reply, queue:create, and a new agents:email channel.

    Make _emit protected so subclasses can use it. Update AIChatAgent to use _emit so message/tool events carry agent identity.

agents@0.7.0

Minor Changes

  • #1024 e9ae070 Thanks @​threepointone! - Overhaul observability: diagnostics_channel, leaner events, error tracking.

    Breaking changes to agents/observability types

    • BaseEvent: Removed id and displayMessage fields. Events now contain only type, payload, and timestamp. The payload type is now strict — accessing undeclared fields is a type error. Narrow on event.type before accessing payload properties.
    • Observability.emit(): Removed the optional ctx second parameter.
    • AgentObservabilityEvent: Split combined union types so each event has its own discriminant (enables proper Extract-based type narrowing). Added new error event types.

    If you have a custom Observability implementation, update your emit signature to emit(event: ObservabilityEvent): void.

    diagnostics_channel replaces console.log

    The default genericObservability implementation no longer logs every event to the console. Instead, events are published to named diagnostics channels using the Node.js diagnostics_channel API. Publishing to a channel with no subscribers is a no-op, eliminating logspam.

    Seven named channels, one per event domain:

    • agents:state — state sync events
    • agents:rpc — RPC method calls and errors
    • agents:message — message request/response/clear/cancel/error + tool result/approval
    • agents:schedule — schedule and queue create/execute/cancel/retry/error events
    • agents:lifecycle — connection and destroy events
    • agents:workflow — workflow start/event/approve/reject/terminate/pause/resume/restart
    • agents:mcp — MCP client connect/authorize/discover events

    New error events

    Error events are now emitted at failure sites instead of (or alongside) console.error:

    • rpc:error — RPC method failures (includes method name and error message)
    • schedule:error — schedule callback failures after all retries exhausted
    • queue:error — queue callback failures after all retries exhausted

    Reduced boilerplate

    All 20+ inline emit blocks in the Agent class have been replaced with a private _emit() helper that auto-generates timestamps, reducing each call site from ~10 lines to 1.

    Typed subscribe helper

... (truncated)

Changelog

Sourced from agents's changelog.

0.7.1

Patch Changes

  • #1046 2cde136 Thanks @​threepointone! - Add agent and name fields to observability events, identifying which agent class and instance emitted each event.

    New events: disconnect (WebSocket close), email:receive, email:reply, queue:create, and a new agents:email channel.

    Make _emit protected so subclasses can use it. Update AIChatAgent to use _emit so message/tool events carry agent identity.

0.7.0

Minor Changes

  • #1024 e9ae070 Thanks @​threepointone! - Overhaul observability: diagnostics_channel, leaner events, error tracking.

    Breaking changes to agents/observability types

    • BaseEvent: Removed id and displayMessage fields. Events now contain only type, payload, and timestamp. The payload type is now strict — accessing undeclared fields is a type error. Narrow on event.type before accessing payload properties.
    • Observability.emit(): Removed the optional ctx second parameter.
    • AgentObservabilityEvent: Split combined union types so each event has its own discriminant (enables proper Extract-based type narrowing). Added new error event types.

    If you have a custom Observability implementation, update your emit signature to emit(event: ObservabilityEvent): void.

    diagnostics_channel replaces console.log

    The default genericObservability implementation no longer logs every event to the console. Instead, events are published to named diagnostics channels using the Node.js diagnostics_channel API. Publishing to a channel with no subscribers is a no-op, eliminating logspam.

    Seven named channels, one per event domain:

    • agents:state — state sync events
    • agents:rpc — RPC method calls and errors
    • agents:message — message request/response/clear/cancel/error + tool result/approval
    • agents:schedule — schedule and queue create/execute/cancel/retry/error events
    • agents:lifecycle — connection and destroy events
    • agents:workflow — workflow start/event/approve/reject/terminate/pause/resume/restart
    • agents:mcp — MCP client connect/authorize/discover events

    New error events

    Error events are now emitted at failure sites instead of (or alongside) console.error:

    • rpc:error — RPC method failures (includes method name and error message)
    • schedule:error — schedule callback failures after all retries exhausted
    • queue:error — queue callback failures after all retries exhausted

    Reduced boilerplate

    All 20+ inline emit blocks in the Agent class have been replaced with a private _emit() helper that auto-generates timestamps, reducing each call site from ~10 lines to 1.

    Typed subscribe helper

    A new subscribe() function is exported from agents/observability with full type narrowing per channel:

... (truncated)

Commits
  • 477d338 Version Packages (#1047)
  • 2cde136 Observability: include agent identity & events (#1046)
    • <...

    Description has been truncated

@dependabot
Bump the minor group across 4 directories with 5 updates
f192fd5 
Bumps the minor group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gunshi](https://github.com/kazupon/gunshi/tree/HEAD/packages/gunshi) | `0.28.2` | `0.29.2` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.20.2` | `1.27.1` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.2.35` | `0.7.1` |
| [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas) | `0.7.2` | `0.10.1` |
| [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt) | `0.6.1` | `0.7.0` |

Bumps the minor group with 1 update in the /packages/varlock directory: [gunshi](https://github.com/kazupon/gunshi/tree/HEAD/packages/gunshi).
Bumps the minor group with 2 updates in the /packages/varlock-docs-mcp directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents).
Bumps the minor group with 2 updates in the /packages/varlock-website directory: [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas) and [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt).


Updates `gunshi` from 0.28.2 to 0.29.2
- [Release notes](https://github.com/kazupon/gunshi/releases)
- [Changelog](https://github.com/kazupon/gunshi/blob/main/CHANGELOG.md)
- [Commits](https://github.com/kazupon/gunshi/commits/v0.29.2/packages/gunshi)

Updates `@modelcontextprotocol/sdk` from 1.20.2 to 1.27.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.20.2...v1.27.1)

Updates `agents` from 0.2.35 to 0.7.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.7.1/packages/agents)

Updates `astro-og-canvas` from 0.7.2 to 0.10.1
- [Release notes](https://github.com/delucis/astro-og-canvas/releases)
- [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-og-canvas/commits/astro-og-canvas@0.10.1/packages/astro-og-canvas)

Updates `starlight-llms-txt` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/delucis/starlight-llms-txt/releases)
- [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md)
- [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.7.0/packages/starlight-llms-txt)

Updates `gunshi` from 0.28.2 to 0.29.2
- [Release notes](https://github.com/kazupon/gunshi/releases)
- [Changelog](https://github.com/kazupon/gunshi/blob/main/CHANGELOG.md)
- [Commits](https://github.com/kazupon/gunshi/commits/v0.29.2/packages/gunshi)

Updates `@modelcontextprotocol/sdk` from 1.20.2 to 1.27.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.20.2...v1.27.1)

Updates `agents` from 0.2.35 to 0.7.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.7.1/packages/agents)

Updates `astro-og-canvas` from 0.7.2 to 0.10.1
- [Release notes](https://github.com/delucis/astro-og-canvas/releases)
- [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-og-canvas/commits/astro-og-canvas@0.10.1/packages/astro-og-canvas)

Updates `starlight-llms-txt` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/delucis/starlight-llms-txt/releases)
- [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md)
- [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.7.0/packages/starlight-llms-txt)

---
updated-dependencies:
- dependency-name: gunshi
  dependency-version: 0.29.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: agents
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: astro-og-canvas
  dependency-version: 0.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: starlight-llms-txt
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: gunshi
  dependency-version: 0.29.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: agents
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: astro-og-canvas
  dependency-version: 0.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: starlight-llms-txt
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 2, 2026
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Mar 2, 2026 •
edited
Loading

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 varlock-website f192fd5 Mar 02 2026, 02:16 PM

@changeset-bot
Copy link

changeset-bot bot commented Mar 2, 2026

⚠️ No Changeset found

Latest commit: f192fd5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security
Copy link

socket-security bot commented Mar 2, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​1password/​sdk-core@​0.4.1-beta.11001006891100
Updatedgunshi@​0.28.2 ⏵ 0.29.284 +1100100 +196 +1100
Added@​1password/​sdk@​0.4.1-beta.110010010091100
Addedzod@​4.3.610010010093100
Addedwrangler@​4.69.0981009596100
Addedagents@​0.7.19910010098100
Added@​modelcontextprotocol/​sdk@​1.27.19910010099100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

community dependencies Pull requests that update a dependency file docs javascript Pull requests that update javascript code varlock

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants