chore(deps): bump the npm-minor-patch group in /plugins/miro with 3 updates

[dependabot]

Bumps the npm-minor-patch group in /plugins/miro with 3 updates: @modelcontextprotocol/sdk, @biomejs/biome and @types/node.

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in modelcontextprotocol/typescript-sdk#1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in modelcontextprotocol/typescript-sdk#1839
• Add end-to-end test suite by @​felixweinberger in modelcontextprotocol/typescript-sdk#2167
• v1 stdio buffer limit by @​KKonstantinov in modelcontextprotocol/typescript-sdk#2239
• fix: support Zod 3.25 method literals by @​mattzcarey in modelcontextprotocol/typescript-sdk#2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in modelcontextprotocol/typescript-sdk#2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in modelcontextprotocol/typescript-sdk#2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2547
• chore: bump version to 1.30.0 by @​felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

• @​mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503
• @​arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

• 2d889f2 chore: bump version to 1.30.0 (#2563)
• e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
• bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
• 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
• 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
• 369513d fix: support Zod 3.25 method literals (#2368)
• e7ee57c v1 stdio buffer limit (#2239)
• c36e1ef Add end-to-end test suite (#2167)
• bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
• 9edbab7 fix(server): prioritize zod issues and format them (#1503)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.

Updates @biomejs/biome from 2.5.5 to 2.5.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

• #10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• See full diff in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @kyle-sexton's task in 2m 21s —— View job

---

Security Review — PR #1952 (dependabot npm-minor-patch bump, plugins/miro)

• Gather context (PR diff, changed files)
• Review plugins/miro/package.json version bumps
• Review plugins/miro/package-lock.json changes
• Review plugins/miro/dist/index.min.js bundle diff
• Post final findings

No security issues found.

This PR is a routine dependency bump (@modelcontextprotocol/sdk 1.29.0→1.30.0, @biomejs/biome 2.5.5→2.5.6, @types/node 26.1.1→26.1.2) plus a regenerated committed bundle. Scope reviewed:

• package.json — clean semver-caret bumps only, no dependency additions/removals, no loosened ranges.
• package-lock.json — all updated entries resolve to the legitimate registry.npmjs.org with integrity hashes present; no new packages, no registry/host changes. @hono/node-server (transitive dep of the MCP SDK) is pinned at 1.19.14, which is the version that fixes the GHSA-frvp-7c67-39w9 advisory cited in the SDK's 1.30.0 release notes.
• dist/index.min.js — regenerated bundle from the version bump (companion commit e87e593). Diffed against the prior committed bundle:
  • Byte size changed by only +384 bytes (1,446,521 → 1,446,905), consistent with the small SSE/keep-alive/Content-Type fixes described in the SDK 1.30.0 changelog — not a wholesale rewrite.
  • The full set of embedded URLs/domains is byte-for-byte identical before and after (api.miro.com, github.com/miroapp/api-clients.git, standard JSON-Schema spec URLs, etc.) — no new endpoints or exfiltration targets introduced.
  • Occurrence counts of dynamic-execution/sensitive-surface primitives (eval(, new Function(, child_process, process.env) are unchanged old vs. new.
• No GitHub Actions workflow files, permissions: blocks, or CI config are touched by this PR — out of scope for pull_request_target/workflow_run/permission-widening concerns.
• Supply-chain / unpinned-action / trigger-pattern risk is covered by zizmor's static advisory lane per this review's scope and is not re-reported here.

No CRITICAL, IMPORTANT, or SUGGESTION findings to report.

[claude]

Claude finished @kyle-sexton's task in 1m 49s —— View job

---

Review: chore(deps): bump npm-minor-patch group in /plugins/miro

• Gather context (PR diff, changed files)
• Review plugins/miro/package.json version bumps
• Review plugins/miro/package-lock.json changes
• Review plugins/miro/dist/index.min.js regenerated bundle
• Post findings

Summary: Routine dependabot dependency bump — no issues found.

• package.json: version specifiers for @modelcontextprotocol/sdk (1.29.0→1.30.0), @biomejs/biome (2.5.5→2.5.6), and @types/node (26.1.1→26.1.2) match the PR description exactly. All are patch/minor bumps within existing ^ ranges.
• package-lock.json: binary diff, consistent with a routine lockfile regeneration for the above bumps.
• dist/index.min.js: the second commit (build(miro): regenerate the committed bundle for the MCP SDK bump) correctly regenerates the committed minified bundle to reflect the SDK source changes (this is required since @modelcontextprotocol/sdk is a runtime dependency, not just a dev dependency). I sampled portions of the ~2.8k-line minified diff and didn't find anything beyond expected reordering/renaming from the version bump — no injected code, no new network endpoints, no eval-style additions.
• The repo's verify-bundle script (plugins/miro/package.json → node build.mjs --check) is wired into the ci workflow, which is the mechanism that would catch a stale/incorrect bundle. That check is green on this PR (I checked CI status via the GitHub CI tool, not by re-running it myself), so the regenerated bundle is confirmed in sync with source by the pipeline, not just by my own inspection.
• No plugin manifest, marketplace schema, hook contract, or documented harness behavior is touched, so the fresh-docs mandate doesn't apply here — this is a pure dependency/build-artifact change.

No correctness, architecture, or maintainability concerns. Security aspects (e.g. the @hono/node-server GHSA fix pulled in transitively by the SDK bump) are left to the claude-security-review lane, which has already completed successfully on this PR.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[kyle-sexton]

Merged. The stale-bundle failure that held this open since 08-05 is now filed as #2083 — Dependabot cannot regenerate plugins/miro/dist/index.min.js, so any bundled import-reachable bump lands red until a human runs npm run bundle. This one needed e87e5932 to clear it.