feat(deps): update dependency @modelcontextprotocol/sdk (1.29.0 → 1.30.0)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@modelcontextprotocol/sdk (source)	1.29.0 → 1.30.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.0

Compare Source

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in #​1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in #​1839
• Add end-to-end test suite by @​felixweinberger in #​2167
• v1 stdio buffer limit by @​KKonstantinov in #​2239
• fix: support Zod 3.25 method literals by @​mattzcarey in #​2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in #​2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in #​2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in #​2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in #​2547
• chore: bump version to 1.30.0 by @​felixweinberger in #​2563

New Contributors

• @​mozmo15 made their first contribution in #​1503
• @​arimu1 made their first contribution in #​2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review: @modelcontextprotocol/sdk 1.29.0 → 1.30.0

Recommendation

Approve. This is a low-risk minor version bump within the 1.x stable line. The upstream changelog contains only bug fixes, internal improvements, and widened dependency constraints — no API surface changes. CI has already confirmed the upgrade is compatible with this codebase.

---

Change Summary

The diff updates only package-lock.json, bumping @modelcontextprotocol/sdk from 1.29.0 to 1.30.0. The lockfile also reflects a widened peer dependency for @hono/node-server (^1.19.9 → ^1.19.9 || ^2.0.5), which is a permissive change and not a regression.

---

Required Checks

✅ check for breaking API changes in updated dependencies

Verified by inspecting the upstream release notes and 10-commit diff for v1.29.0 → v1.30.0:

All 10 commits are patch-level fixes (confirmed by upstream's patch changeset labels) or internal tooling changes (CI, ESLint config):

• Fix SSE keep-alive timer lifecycle in Streamable HTTP transport (patch)
• Send SSE keep-alive comment frames to prevent intermediaries killing idle connections (patch)
• Validate Content-Type by parsed media type instead of substring match (patch) — this is a behavioral improvement that rejects malformed Content-Type values that would have incorrectly passed before
• Prioritize Zod error issue messages over the JSON-blob fallback (patch)
• Support Zod 3.25 method literals (patch)
• Widen @hono/node-server past a security advisory (patch)
• v1 stdio buffer limit (patch)
• End-to-end test suite and CI tooling additions

No breaking API changes. The SDK's exported interfaces, transport APIs, and client/server contracts are unchanged. One behavioral hardening note: POSTs to the Streamable HTTP server transport with non-application/json media types now correctly return 415 Unsupported Media Type — this is a correctness fix, not a regression, and CI already validated this codebase against the new version.

✅ run full test suite after upgrade

CI ran and passed all checks for commit 331fe2d:

Check	Result
review	success
Lint	success
Tests	success
Build	success
Typecheck	success
Docker Build	success

The full test suite, typecheck, lint, and Docker build all passed. No additional testing is required.

---

Standards Compliance

The PR follows repository conventions:

• Only package-lock.json was modified — no hand-editing of package.json or tsconfig.
• The change is scoped and surgical, consistent with the project's Renovate-managed dependency upgrade workflow.
• No secrets, credentials, or environment configurations were touched.

---

Unknowns / Needs Verification

None. The CI results are authoritative evidence that the upgrade integrates correctly with this codebase. The upstream release notes provide sufficient confidence that no API surface was broken. There are no linked issues to evaluate against.