chore(release): bump to 0.5.1 — security dep upgrades

mattpodwysocki · claude · mattpodwysocki · commit 4b443dcb0b1b · 2026-03-04T18:33:51.000-05:00
- Upgrade @mcp-ui/server ^5.13.1 → ^6.1.0 (security advisory); update tests for mimeType change (text/uri-list → text/html;profile=mcp-app)
- Upgrade @modelcontextprotocol/sdk ^1.26.0 → ^1.27.1 (security advisory); regenerated output-validation patch for new version

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 ## Unreleased
 
+## 0.5.1 - 2026-03-04
+
+### Dependencies
+
+- Upgrade `@mcp-ui/server` from `^5.13.1` to `^6.1.0` (security advisory); update tests for mimeType change (`text/uri-list` → `text/html;profile=mcp-app`)
+- Upgrade `@modelcontextprotocol/sdk` from `^1.26.0` to `^1.27.1` (security advisory); regenerated output-validation patch for new version
+
 ## 0.5.0 - 2026-02-24
 
 ### Features Added
diff --git a/manifest.json b/manifest.json
@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "@mapbox/mcp-devkit-server",
   "display_name": "Mapbox MCP DevKit Server",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Mapbox MCP devkit server",
   "author": {
     "name": "Mapbox, Inc."
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/mcp-devkit-server",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Mapbox MCP devkit server",
   "mcpName": "io.github.mapbox/mcp-devkit-server",
   "main": "./dist/commonjs/index.js",
@@ -49,9 +49,9 @@
     "mcp"
   ],
   "dependencies": {
-    "@mcp-ui/server": "^5.13.1",
+    "@mcp-ui/server": "^6.1.0",
     "@modelcontextprotocol/ext-apps": "^1.0.1",
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/auto-instrumentations-node": "^0.56.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.56.0",
@@ -78,13 +78,13 @@
     "globals": "^16.3.0",
     "husky": "^9.0.0",
     "lint-staged": "^16.1.0",
+    "patch-package": "^8.0.1",
     "plop": "^4.0.1",
     "prettier": "^3.0.0",
     "tshy": "^3.0.2",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.42.0",
-    "vitest": "^3.2.4",
-    "patch-package": "^8.0.1"
+    "vitest": "^3.2.4"
   },
   "prettier": {
     "singleQuote": true,
diff --git a/patches/@modelcontextprotocol+sdk+1.26.0.patch b/patches/@modelcontextprotocol+sdk+1.26.0.patch
diff --git a/patches/@modelcontextprotocol+sdk+1.27.1.patch b/patches/@modelcontextprotocol+sdk+1.27.1.patch
@@ -0,0 +1,33 @@
+diff --git a/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js b/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+index 23639ce..7b8a325 100644
+--- a/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
++++ b/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+@@ -194,15 +194,20 @@ export class McpServer {
+             return;
+         }
+         if (!result.structuredContent) {
+-            throw new McpError(ErrorCode.InvalidParams, `Output validation error: Tool ${toolName} has an output schema but no structured content was provided`);
++            // Log warning but don't throw - allow tools to omit structured content
++            console.warn(`[MCP SDK Patch] Output validation warning: Tool ${toolName} has an output schema but no structured content was provided`);
+         }
+-        // if the tool has an output schema, validate structured content
+-        const outputObj = normalizeObjectSchema(tool.outputSchema);
+-        const parseResult = await safeParseAsync(outputObj, result.structuredContent);
+-        if (!parseResult.success) {
+-            const error = 'error' in parseResult ? parseResult.error : 'Unknown error';
+-            const errorMessage = getParseErrorMessage(error);
+-            throw new McpError(ErrorCode.InvalidParams, `Output validation error: Invalid structured content for tool ${toolName}: ${errorMessage}`);
++        else {
++            // if the tool has an output schema, validate structured content
++            const outputObj = normalizeObjectSchema(tool.outputSchema);
++            const parseResult = await safeParseAsync(outputObj, result.structuredContent);
++            if (!parseResult.success) {
++                const error = 'error' in parseResult ? parseResult.error : 'Unknown error';
++                const errorMessage = getParseErrorMessage(error);
++                // Log warning but don't throw - allow schema mismatches
++                console.warn(`[MCP SDK Patch] Output validation warning: Invalid structured content for tool ${toolName}: ${errorMessage}`);
++                // Keep the structuredContent despite validation failure
++            }
+         }
+     }
+     /**
diff --git a/server.json b/server.json
@@ -6,13 +6,13 @@
     "url": "https://github.com/mapbox/mcp-devkit-server",
     "source": "github"
   },
-  "version": "0.5.0",
+  "version": "0.5.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "runtimeHint": "npx",
-      "version": "0.5.0",
+      "version": "0.5.1",
       "identifier": "@mapbox/mcp-devkit-server",
       "transport": {
         "type": "stdio"
diff --git a/test/tools/geojson-preview-tool/GeojsonPreviewTool.test.ts b/test/tools/geojson-preview-tool/GeojsonPreviewTool.test.ts
@@ -49,7 +49,7 @@ describe('GeojsonPreviewTool', () => {
       type: 'resource',
       resource: {
         uri: expect.stringMatching(/^ui:\/\/mapbox\/geojson-preview\//),
-        mimeType: 'text/uri-list',
+        mimeType: 'text/html;profile=mcp-app',
         text: expect.stringMatching(/^https:\/\//)
       }
     });
diff --git a/test/tools/preview-style-tool/PreviewStyleTool.test.ts b/test/tools/preview-style-tool/PreviewStyleTool.test.ts
@@ -164,7 +164,7 @@ describe('PreviewStyleTool', () => {
       type: 'resource',
       resource: {
         uri: expect.stringMatching(/^ui:\/\/mapbox\/preview-style\//),
-        mimeType: 'text/uri-list',
+        mimeType: 'text/html;profile=mcp-app',
         text: expect.stringContaining(
           'https://api.mapbox.com/styles/v1/test-user/test-style.html?access_token=pk.'
         )
diff --git a/test/tools/style-comparison-tool/StyleComparisonTool.test.ts b/test/tools/style-comparison-tool/StyleComparisonTool.test.ts
@@ -42,7 +42,7 @@ describe('StyleComparisonTool', () => {
           uri: expect.stringMatching(
             /^ui:\/\/mapbox\/style-comparison\/mapbox\/streets-v12\/mapbox\/outdoors-v12$/
           ),
-          mimeType: 'text/uri-list',
+          mimeType: 'text/html;profile=mcp-app',
           text: expect.stringContaining(
             'https://agent.mapbox.com/tools/style-compare'
           )

Original file line number	Diff line number	Diff line change
`@@ -49,7 +49,7 @@ describe('GeojsonPreviewTool', () => {`
`49`	`49`	`type: 'resource',`
`50`	`50`	`resource: {`
`51`	`51`	`uri: expect.stringMatching(/^ui:\/\/mapbox\/geojson-preview\//),`
`52`		`- mimeType: 'text/uri-list',`
	`52`	`+ mimeType: 'text/html;profile=mcp-app',`
`53`	`53`	`text: expect.stringMatching(/^https:\/\//)`
`54`	`54`	`}`
`55`	`55`	`});`
Original file line number	Diff line number	Diff line change
`@@ -164,7 +164,7 @@ describe('PreviewStyleTool', () => {`
`164`	`164`	`type: 'resource',`
`165`	`165`	`resource: {`
`166`	`166`	`uri: expect.stringMatching(/^ui:\/\/mapbox\/preview-style\//),`
`167`		`- mimeType: 'text/uri-list',`
	`167`	`+ mimeType: 'text/html;profile=mcp-app',`
`168`	`168`	`text: expect.stringContaining(`
`169`	`169`	`'https://api.mapbox.com/styles/v1/test-user/test-style.html?access_token=pk.'`
`170`	`170`	`)`
Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,7 @@ describe('StyleComparisonTool', () => {`
`42`	`42`	`uri: expect.stringMatching(`
`43`	`43`	`/^ui:\/\/mapbox\/style-comparison\/mapbox\/streets-v12\/mapbox\/outdoors-v12$/`
`44`	`44`	`),`
`45`		`- mimeType: 'text/uri-list',`
	`45`	`+ mimeType: 'text/html;profile=mcp-app',`
`46`	`46`	`text: expect.stringContaining(`
`47`	`47`	`'https://agent.mapbox.com/tools/style-compare'`
`48`	`48`	`)`