v1.7.5

What's Changed

SDK

• Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @victor-openai in #721

Specification

• Add missing HostCapabilities fields by @hydrosquall in #653
• Sync object-src with default-src by @domfarolino in #715

Examples

• lazy-auth-server: usable on mobile in #714
• map-server: fix README and code of conduct links in #657

Docs

• API Docs link for ext-apps/server in #697
• Add mcp-use inspector badge to supported clients by @pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

• shell-quote 1.9.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv)
• @babel/core 7.29.7 (GHSA-4x5r-pxfx-6jf8)
• sharp ^0.35.3 (GHSA-f88m-g3jw-g9cj; libvips CVE-2026-33327 / 33328 / 35590 / 35591) — devDependency, screenshot tooling only
• brace-expansion 1.1.16 / 2.1.2, fast-uri 3.1.4, hono 4.12.31, linkify-it 5.0.2, markdown-it 14.3.0, body-parser 2.3.0, plus other transitives

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: v1.7.4...v1.7.5