Triage 7 non-Node-20 dependabot PRs (typescript, vitest, @types/node, MCP SDK bumps)

[TMHSDigital]

During Phase 2 of DTD#18 work, 7 dependabot PRs were identified as unrelated to Node 20 deprecation:

• Docker stale-counts findings in SKILL.md files (Home-Lab, Steam) need investigation #13 (@modelcontextprotocol/sdk 1.28.0 -> 1.29.0)
• Docker Phase 3: semantic drift detection (principle wording, contradictions) #17 (@types/node 25.5.0 -> 25.6.0)
• Docker Node 20 deprecation: bump actions/setup-python and other Node 20 actions before 2026-06-02 #18 (vitest 4.1.2 -> 4.1.4)
• Docker fix: release-doc-sync action checkout pollutes caller's working tree #20 (typescript 6.0.2 -> 6.0.3)
• Home-Lab chore: finish Phase 1 with standards template and scaffold updates #6 (@types/node 25.5.2 -> 25.6.0)
• Home-Lab feat: drift checker additional checks and policy data (Phase 2 Session B) #8 (vitest 4.1.2 -> 4.1.4)
• Home-Lab Ecosystem drift report (live) #10 (typescript 5.9.3 -> 6.0.3)

These were punted from the Node 20 work to avoid scope creep. Each may have implications:

• TypeScript major bumps (Home-Lab 5.9.3 -> 6.0.3 is a major) could affect type-checking strictness
• vitest bumps could affect test API
• MCP SDK bumps could affect compatibility with MCP servers

Action: dedicated triage session. Each PR evaluated for compatibility before merge.

Filed during DTD#18 Phase 2.

[TMHSDigital]

Triage results from 2026-04-25:

Safe-merged (5 PRs, patch/minor/types):

• Docker Phase 3: semantic drift detection (principle wording, contradictions) #17: @types/node 25.5.0 -> 25.6.0 (types only, minor) -> 514627f
• Docker Node 20 deprecation: bump actions/setup-python and other Node 20 actions before 2026-06-02 #18: vitest 4.1.2 -> 4.1.4 (patch within v4) -> 9ad5633
• Docker fix: release-doc-sync action checkout pollutes caller's working tree #20: typescript 6.0.2 -> 6.0.3 (patch within v6, post-rebase) -> bb0dfae
• Home-Lab chore: finish Phase 1 with standards template and scaffold updates #6: @types/node 25.5.2 -> 25.6.0 (types only, minor) -> 3925af5
• Home-Lab feat: drift checker additional checks and policy data (Phase 2 Session B) #8: vitest 4.1.2 -> 4.1.4 (patch within v4) -> 623c867

Reviewed and merged (1 PR, major bump with green relevant CI):

• Home-Lab Ecosystem drift report (live) #10: typescript 5.9.3 -> 6.0.3 (MAJOR 5 -> 6, post-rebase) -> 8a96c15
  • Relevant CI checks (typecheck, test, lint) all green
  • Only failing check was the pre-existing "Auto-label by path" workflow, which is unrelated to the bump

Deferred for manual review (1 PR):

• Docker stale-counts findings in SKILL.md files (Home-Lab, Steam) need investigation #13: @modelcontextprotocol/sdk 1.28.0 -> 1.29.0
  • The meta-repo's MCP servers depend on stable SDK behavior; minor bumps in this dependency warrant a dedicated investigation session before merging
  • PR's CI is green, but the version delta may include behavior changes worth verifying against the upstream changelog
  • Comment posted on the PR noting the deferral

This issue stays OPEN as a tracker for Docker #13. Once that PR is reviewed and merged (or closed), this issue can be closed.

Note on Docker #20 and Home-Lab #10: both required @dependabot rebase after their sibling vitest PRs landed (package-lock.json conflicts). Both rebased cleanly and merged.

[TMHSDigital]

All 7 originally-deferred PRs from DTD#18 work are now processed. Final PR (Docker #13, @modelcontextprotocol/sdk 1.28.0 -> 1.29.0) merged 2026-04-25 after compatibility review.

SDK usage audit: Docker's mcp-server uses only McpServer (from @modelcontextprotocol/sdk/server/mcp.js) and StdioServerTransport (from @modelcontextprotocol/sdk/server/stdio.js). All 95+ tool files import only the McpServer type.

1.29.0 changelog vs Docker usage:

• Backports/additive: ResourceSchema size field, typings exports, capability extensions, windowsHide always-on for stdio child processes (not relevant to server-side Stdio transport), npm audit fix.
• Single behavior change of note: disallow null (infinite) requested TTL (#1339). Docker does not call any TTL-bearing API; not applicable.

CI: All checks pass (CodeQL, Socket Security, build-and-test 20/22, dependency-review, validate, update-release-draft).

Closing DTD#33. Backlog from DTD#18 work is fully drained.