build: update all non-major dependencies

[angular-robot]

This PR contains the following updates:

Package	Type	Update	Change
@babel/core (source)	dependencies	patch	7.27.4 -> 7.27.7
@modelcontextprotocol/sdk (source)	dependencies	patch	1.13.1 -> 1.13.2
github/codeql-action	action	patch	v3.29.0 -> v3.29.1
undici (source)	devDependencies	minor	7.10.0 -> 7.11.0

---

Release Notes

babel/babel (@​babel/core)

v7.27.7

Compare Source

👓 Spec Compliance

• babel-parser, babel-plugin-transform-classes
  • #​17203 Interepret parser allow* options as top level only (@​JLHwung)
• babel-parser
  • #​17371 fix: disable using in ambient context (@​JLHwung)

🐛 Bug Fix

• babel-core
  • #​17392 Improve TS babel config loading (@​JLHwung)
• babel-types
  • #​17376 fix: support negative bigint in valueToNode (@​JLHwung)
• babel-plugin-transform-parameters
  • #​17352 fix: Params of async function* should throw synchronously (@​liuxingbaoyu)

🏠 Internal

• babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
  • #​17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.13.2

Compare Source

What's Changed

• Fix /.well-known/oauth-authorization-server dropping path by @​calclavia in https://github.com/modelcontextprotocol/typescript-sdk/pull/687
• Fallback for /.well-known/oauth-authorization-server dropping path by @​ihrpr in https://github.com/modelcontextprotocol/typescript-sdk/pull/692
• [auth] refactor resource selection to not include resource if PRM is not present by @​pcarleton in https://github.com/modelcontextprotocol/typescript-sdk/pull/693
• fix: skip validation if tool reports error by @​Areo-Joe in https://github.com/modelcontextprotocol/typescript-sdk/pull/655
• feat(shared/auth): support software_statement in OAuthClientMetadata by @​chrisdickinson in https://github.com/modelcontextprotocol/typescript-sdk/pull/696
• Show session id per request in simpleStreamableHttp example server by @​cliffhall in https://github.com/modelcontextprotocol/typescript-sdk/pull/640
• Raw request propagation in tools - passed to callbacks via RequestHandlerExtra<ServerRequest, ServerNotification> by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/627
• Update readme file to include a tip to allow mcp-session-id in CORS when using StreamableHTTP by @​Achintha444 in https://github.com/modelcontextprotocol/typescript-sdk/pull/633
• Pr/protocol overwriting transport hooks by @​nichtsam in https://github.com/modelcontextprotocol/typescript-sdk/pull/477
• docs: Add clarifying comments for stateless streamable HTTP endpoints by @​dhodun in https://github.com/modelcontextprotocol/typescript-sdk/pull/542
• Bump formidable from 3.5.2 to 3.5.4 in the npm_and_yarn group across 1 directory by @​dependabot in https://github.com/modelcontextprotocol/typescript-sdk/pull/428
• test(server): add more tests for SSEServerTransport class by @​christian-bromann in https://github.com/modelcontextprotocol/typescript-sdk/pull/391
• Update version of the package to 1.13.2 by @​ihrpr in https://github.com/modelcontextprotocol/typescript-sdk/pull/701

New Contributors 🙏

• @​calclavia made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/687
• @​Areo-Joe made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/655
• @​KKonstantinov made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/627
• @​Achintha444 made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/633
• @​nichtsam made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/477
• @​dhodun made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/542
• @​christian-bromann made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/391

Full Changelog: modelcontextprotocol/typescript-sdk@1.13.1...1.13.2

github/codeql-action (github/codeql-action)

v3.29.1

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.1 - 27 Jun 2025

• Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #​2938
• Update default CodeQL bundle version to 2.22.1. #​2950

See the full CHANGELOG.md for more information.

nodejs/undici (undici)

v7.11.0

Compare Source

What's Changed

• Update WPT by @​github-actions in https://github.com/nodejs/undici/pull/4214
• feat(fetch): add zstandard decompression support by @​J3m5 in https://github.com/nodejs/undici/pull/4238
• fix(debug): remove extra forward slash in logs by @​aidant in https://github.com/nodejs/undici/pull/4236
• types: EventSource short handlers can be null by @​Uzlopak in https://github.com/nodejs/undici/pull/4246
• remove finalizationregistry workaround by @​mcollina in https://github.com/nodejs/undici/pull/4250
• build(deps): bump actions/dependency-review-action from 4.5.0 to 4.7.1 by @​dependabot in https://github.com/nodejs/undici/pull/4255
• build(deps): bump github/codeql-action from 3.28.1 to 3.28.18 by @​dependabot in https://github.com/nodejs/undici/pull/4252
• build(deps): bump codecov/codecov-action from 5.1.2 to 5.4.3 by @​dependabot in https://github.com/nodejs/undici/pull/4253
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @​dependabot in https://github.com/nodejs/undici/pull/4254
• Query unaware interceptors cache fix by @​FelixVaughan in https://github.com/nodejs/undici/pull/4240
• docs: fix interceptor order description in compose method by @​mcollina in https://github.com/nodejs/undici/pull/4251
• chore: require node native modules with node:-prefix by @​Uzlopak in https://github.com/nodejs/undici/pull/4256
• fix: eventsource does not reconnect on network error by @​Uzlopak in https://github.com/nodejs/undici/pull/4247
• fix: add guard by @​GeoffreyBooth in https://github.com/nodejs/undici/pull/4262
• Extract webidl by @​Uzlopak in https://github.com/nodejs/undici/pull/4259
• build(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 by @​dependabot in https://github.com/nodejs/undici/pull/4132
• build(deps-dev): bump fast-check from 3.23.2 to 4.1.1 by @​dependabot in https://github.com/nodejs/undici/pull/4167
• build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.2 by @​dependabot in https://github.com/nodejs/undici/pull/4137
• build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @​dependabot in https://github.com/nodejs/undici/pull/4168
• build(deps): bump hendrikmuhs/ccache-action from 1.2.14 to 1.2.18 by @​dependabot in https://github.com/nodejs/undici/pull/4190
• build(deps): bump fastify/github-action-merge-dependabot from 3.11.0 to 3.11.1 by @​dependabot in https://github.com/nodejs/undici/pull/4135
• build(deps): bump step-security/harden-runner from 2.11.1 to 2.12.0 by @​dependabot in https://github.com/nodejs/undici/pull/4188
• build(deps-dev): bump borp from 0.19.0 to 0.20.0 by @​dependabot in https://github.com/nodejs/undici/pull/4194
• Fix several WPT failures by @​tsctx in https://github.com/nodejs/undici/pull/4263
• Update WPT by @​github-actions in https://github.com/nodejs/undici/pull/4235
• node.js fetch is wrongly typed (#​4271) by @​bpasero in https://github.com/nodejs/undici/pull/4272
• Fix: Provide body on retry error, preserve socket by @​fatal10110 in https://github.com/nodejs/undici/pull/4228
• add cause to WebSocket error by @​KhafraDev in https://github.com/nodejs/undici/pull/4274
• doc: undici vs fetch by @​FelixVaughan in https://github.com/nodejs/undici/pull/4245
• bench: add websockets by @​tsctx in https://github.com/nodejs/undici/pull/3203
• webidl: remove fallback for USVString by @​Uzlopak in https://github.com/nodejs/undici/pull/4264
• fix: Use correct Dispatcher.RequestOptions by @​IvanDimanov-OfficeRnD in https://github.com/nodejs/undici/pull/4281
• feat: add install() function for global WHATWG fetch classes by @​mcollina in https://github.com/nodejs/undici/pull/4286
• Fixed RedirectHandler type by @​rahulyadav5524 in https://github.com/nodejs/undici/pull/4278
• feat(#​4086): proxy keep alive by @​metcoder95 in https://github.com/nodejs/undici/pull/4128
• Add cleanMocks to MockClient and MockPool by @​DemianParkhomenko in https://github.com/nodejs/undici/pull/4176
• fetch: add missing new operator on TypeError instantiation in readAllBytes by @​Uzlopak in https://github.com/nodejs/undici/pull/4297
• Skip failing wpts by @​mcollina in https://github.com/nodejs/undici/pull/4294
• feat: add request body diagnostic channels by @​legendecas in https://github.com/nodejs/undici/pull/4289
• Fix timer guards to avoid TypeError under fake‐timers and polyfilled … by @​1ly4s0 in https://github.com/nodejs/undici/pull/4213
• cache: update MemoryCacheStore default limits by @​mcollina in https://github.com/nodejs/undici/pull/4292
• fix: EnvHttpProxyAgent.Options should accept ProxyAgent.Options by @​urugator in https://github.com/nodejs/undici/pull/4243

New Contributors

• @​J3m5 made their first contribution in https://github.com/nodejs/undici/pull/4238
• @​aidant made their first contribution in https://github.com/nodejs/undici/pull/4236
• @​bpasero made their first contribution in https://github.com/nodejs/undici/pull/4272
• @​IvanDimanov-OfficeRnD made their first contribution in https://github.com/nodejs/undici/pull/4281
• @​rahulyadav5524 made their first contribution in https://github.com/nodejs/undici/pull/4278
• @​DemianParkhomenko made their first contribution in https://github.com/nodejs/undici/pull/4176
• @​1ly4s0 made their first contribution in https://github.com/nodejs/undici/pull/4213
• @​urugator made their first contribution in https://github.com/nodejs/undici/pull/4243

Full Changelog: nodejs/undici@v7.10.0...v7.11.0

---

Configuration

📅 Schedule: Branch creation - "after 10:00pm every weekday,before 5:00am every weekday,every weekend" in timezone America/Tijuana, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}