chore(deps): bump the production-minor group across 1 directory with 5 updates by dependabot[bot] · Pull Request #137 · webrenew/unicon

dependabot · 2026-04-01T20:46:35Z

Bumps the production-minor group with 5 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	`1.27.1`	`1.29.0`
@opentelemetry/sdk-trace-node	`2.6.0`	`2.6.1`
@sentry/nextjs	`10.45.0`	`10.47.0`
drizzle-orm	`0.45.1`	`0.45.2`
resend	`6.9.4`	`6.10.0`

Updates @modelcontextprotocol/sdk from 1.27.1 to 1.29.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

fix: treat v1.x as primary branch for npm latest tag (backport #1577) by @felixweinberger in modelcontextprotocol/typescript-sdk#1749

[v1.x] fix: disallow null (infinite) requested TTL by @LucaButBoring in modelcontextprotocol/typescript-sdk#1339

[v1.x] fix: add missing size field to ResourceSchema by @olaservo in modelcontextprotocol/typescript-sdk#1575

Add typings exports by @tdraier in modelcontextprotocol/typescript-sdk#1623

v1.x npm audit fix by @KKonstantinov in modelcontextprotocol/typescript-sdk#1780

v1.x #1623 follow up -add missing types to package.json by @KKonstantinov in modelcontextprotocol/typescript-sdk#1773

[v1.x backport] Allow servers / clients to advertise extensions in the capability object by @localden in modelcontextprotocol/typescript-sdk#1811

fix(stdio): always set windowsHide on Windows, not just in Electron by @jnMetaCode in modelcontextprotocol/typescript-sdk#1640

chore: bump version to 1.29.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1820

New Contributors

@tdraier made their first contribution in modelcontextprotocol/typescript-sdk#1623

@jnMetaCode made their first contribution in modelcontextprotocol/typescript-sdk#1640

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

What's Changed

feat: use scopes_supported from resource metadata by default (fixes #580) by @antogyn in modelcontextprotocol/typescript-sdk#757

[v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by @pcarleton in modelcontextprotocol/typescript-sdk#1611

fix: reject plain JSON Schema objects passed as inputSchema by @tiluckdave in modelcontextprotocol/typescript-sdk#1596

fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by @pcarleton in modelcontextprotocol/typescript-sdk#1462

fix(server/auth): RFC 8252 loopback port relaxation by @poteat in modelcontextprotocol/typescript-sdk#1738

chore: bump version to 1.28.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1746

New Contributors

@antogyn made their first contribution in modelcontextprotocol/typescript-sdk#757

@tiluckdave made their first contribution in modelcontextprotocol/typescript-sdk#1596

@poteat made their first contribution in modelcontextprotocol/typescript-sdk#1738

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

Commits

e12cbd7 chore: bump version to 1.29.0 (#1820)
3913fd4 fix(stdio): always set windowsHide on Windows, not just in Electron (#1640)
5608e78 [v1.x backport] Allow servers / clients to advertise extensions in the capabi...
7213816 v1.x #1623 follow up -add missing types to package.json (#1773)
364f38c v1.x npm audit fix (#1780)
c95cc09 Add typings exports (#1623)
ddadaa6 [v1.x] fix: add missing size field to ResourceSchema (#1575)
2a15851 [v1.x] fix: disallow null (infinite) requested TTL (#1339)
13e30f1 fix: treat v1.x as primary branch for npm latest tag (backport #1577) (#1749)
a056569 chore: bump version to 1.28.0 (#1746)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-trace-node from 2.6.0 to 2.6.1

Release notes

Sourced from @opentelemetry/sdk-trace-node's releases.

v2.6.1

2.6.1

🐛 Bug Fixes

fix(opentelemetry-instrumentation): improve _warnOnPreloadedModules function not to show warning logs when the module is not marked as loaded #6095 @rlj1202

fix(sdk-trace-base): derive internal SpanOptions from API type to prevent drift #6478 @overbalance

fix(span): enforce attributePerEventCountLimit, attributePerLinkCountLimit, linkCountLimit, and attributeValueLengthLimit for event/link attributes #6479 @overbalance

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

perf(sdk-trace-base): avoid Object.entries in Span.setAttributes #6514 @daniellockyer

perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance #6516 @daniellockyer

test(bundlers): broaden bundler test coverage and assert known protobuf dynamic-require failures #6482 @overbalance

Changelog

Sourced from @opentelemetry/sdk-trace-node's changelog.

2.6.1

🐛 Bug Fixes

fix(opentelemetry-instrumentation): improve _warnOnPreloadedModules function not to show warning logs when the module is not marked as loaded #6095 @rlj1202

fix(sdk-trace-base): derive internal SpanOptions from API type to prevent drift #6478 @overbalance

fix(span): enforce attributePerEventCountLimit, attributePerLinkCountLimit, linkCountLimit, and attributeValueLengthLimit for event/link attributes #6479 @overbalance

fix(context-zone): guard onCancelTask against terminal-state tasks to prevent infinite loop with rc-align (Ant Design) in React 16 dev mode #6512 @Renegade2345

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

perf(sdk-trace-base): avoid Object.entries in Span.setAttributes #6514 @daniellockyer

perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance #6516 @daniellockyer

test(bundlers): broaden bundler test coverage and assert known protobuf dynamic-require failures #6482 @overbalance

Commits

7e74509 chore: prepare next release (#6510)
c846919 fix(instrumentation-fetch): do not modify the returned type of fetch (#6521)
99fb3fb fix(api): re-introduce fallback chain for global utils (#6523)
b842717 test(bundlers): add node webpack tests, expand edge coverage, assert known pr...
b5a6b12 fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base de...
dc93ed4 perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance (#6516)
e9831e7 perf(sdk-trace-base): avoid Object.entries in Span.setAttributes (#6514)
d56af69 chore(deps): lock file maintenance (#6517)
f3a10ab chore(deps): update github/codeql-action digest to 3869755 (#6513)
2f73776 chore(deps): update github/codeql-action digest to c6f9311 (#6511)
Additional commits viewable in compare view

Updates @sentry/nextjs from 10.45.0 to 10.47.0

Release notes

Sourced from @sentry/nextjs's releases.

10.47.0

Important Changes
feat(node-core): Add OTLP integration for node-core/light (#19729)

Added otlpIntegration at @sentry/node-core/light/otlp for users who manage their own OpenTelemetry setup and want to send trace data to Sentry without adopting the full @sentry/node SDK.
import { NodeTracerProvider } from '@opentelemetry/sdk-trace-node';
import * as Sentry from '@sentry/node-core/light';
import { otlpIntegration } from '@sentry/node-core/light/otlp';
const provider = new NodeTracerProvider();
provider.register();
Sentry.init({
dsn: 'DSN',
integrations: [
otlpIntegration({
// Export OTel spans to Sentry via OTLP (default: true)
setupOtlpTracesExporter: true,
}),
],
});
The integration links Sentry errors to OTel traces and exports spans to Sentry via OTLP.
feat(node, bun): Add runtime metrics integrations for Node.js and Bun (#19923, #19979)

New nodeRuntimeMetricsIntegration and bunRuntimeMetricsIntegration automatically collect runtime health metrics and send them to Sentry on a configurable interval (default: 30s). Collected metrics include memory (RSS, heap used/total), CPU utilization, event loop utilization, and process uptime. Node additionally collects event loop delay percentiles (p50, p99). Extra metrics like CPU time and external memory are available as opt-in.
// Node.js
import * as Sentry from '@sentry/node';
Sentry.init({
dsn: '...',
integrations: [Sentry.nodeRuntimeMetricsIntegration()],
});
// Bun
import * as Sentry from '@sentry/bun';
Sentry.init({
dsn: '...',
integrations: [Sentry.bunRuntimeMetricsIntegration()],
});

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

10.47.0

Important Changes
feat(node-core): Add OTLP integration for node-core/light (#19729)

Added otlpIntegration at @sentry/node-core/light/otlp for users who manage their own OpenTelemetry setup and want to send trace data to Sentry without adopting the full @sentry/node SDK.
import { NodeTracerProvider } from '@opentelemetry/sdk-trace-node';
import * as Sentry from '@sentry/node-core/light';
import { otlpIntegration } from '@sentry/node-core/light/otlp';
const provider = new NodeTracerProvider();
provider.register();
Sentry.init({
dsn: 'DSN',
integrations: [
otlpIntegration({
// Export OTel spans to Sentry via OTLP (default: true)
setupOtlpTracesExporter: true,
}),
],
});
The integration links Sentry errors to OTel traces and exports spans to Sentry via OTLP.
feat(node, bun): Add runtime metrics integrations for Node.js and Bun (#19923, #19979)

New nodeRuntimeMetricsIntegration and bunRuntimeMetricsIntegration automatically collect runtime health metrics and send them to Sentry on a configurable interval (default: 30s). Collected metrics include memory (RSS, heap used/total), CPU utilization, event loop utilization, and process uptime. Node additionally collects event loop delay percentiles (p50, p99). Extra metrics like CPU time and external memory are available as opt-in.
// Node.js
import * as Sentry from '@sentry/node';
Sentry.init({
dsn: '...',
integrations: [Sentry.nodeRuntimeMetricsIntegration()],
});
// Bun
import * as Sentry from '@sentry/bun';
Sentry.init({
dsn: '...',
integrations: [Sentry.bunRuntimeMetricsIntegration()],

... (truncated)

Commits

a5a4e73 release: 10.47.0
c7477bb Merge pull request #20050 from getsentry/prepare-release/10.47.0
3d4e38d meta(changelog): Update changelog for 10.47.0
2c0ce6f feat(deps): Bump OpenTelemetry dependencies (#20046)
8f08fcb fix(browser-tests): Pin axios to 1.13.5 to avoid compromised 1.14.1 (#20047)
3815492 fix(profiling): Disable profiling in worker threads (#20040)
61edc25 Merge pull request #19890 from getsentry/fix/react-router-debug-id-double-inj...
28f94f3 fix(react-router): Disable debug ID injection in Vite plugin to prevent doubl...
9bfc682 ref(browser-tests): Add waitForMetricRequest helper (#20002)
08cab24 fix(node): Deduplicate sentry-trace and baggage headers on outgoing reque...
Additional commits viewable in compare view

Updates drizzle-orm from 0.45.1 to 0.45.2

Release notes

Sourced from drizzle-orm's releases.

0.45.2

Fixed sql.identifier(), sql.as() escaping issues. Previously all the values passed to this functions were not properly escaped causing a possible SQL Injection (CWE-89) vulnerability

Thanks to @EthanKim88, @0x90sh and @wgoodall01 for reaching out to us with a reproduction and suggested fix

Commits

273c780 + 0.45.2 (#5534)
4aa6ecf Kit updates (#5490)
e8e6edf feat(drizzle-kit): support d1 via binding (#5302)
See full diff in compare view

Updates resend from 6.9.4 to 6.10.0

Release notes

Sourced from resend's releases.

v6.10.0

What's Changed

fix(deps): update dependency next to v16.1.7 [security] by @renovate[bot] in resend/resend-node#884

chore(deps): update dependency pkg-pr-new to v0.0.66 by @renovate[bot] in resend/resend-node#880

chore(deps): update dependency vitest to v4.1.0 by @renovate[bot] in resend/resend-node#876

fix(deps): update dependency postal-mime to v2.7.4 by @renovate[bot] in resend/resend-node#886

fix(deps): update dependency esbuild to v0.27.4 by @renovate[bot] in resend/resend-node#875

fix(deps): update dependency next to v16.2.0 by @renovate[bot] in resend/resend-node#882

chore(deps): update pnpm to v10.32.1 by @renovate[bot] in resend/resend-node#871

chore(deps): update dependency tsdown to v0.21.4 by @renovate[bot] in resend/resend-node#872

chore(deps): update tj-actions/changed-files digest to 445b0eb by @renovate[bot] in resend/resend-node#870

fix(deps): update dependency svix to v1.88.0 by @renovate[bot] in resend/resend-node#873

feat(ci): split script and workflow for e2e test by @gabrielmfern in resend/resend-node#887

chore(deps): update dependency @types/node to v24.12.0 by @renovate[bot] in resend/resend-node#869

chore(ci): pin GitHub Actions workflows to commit SHAs by @gabrielmfern in resend/resend-node#889

feat: support logs endpoints by @felipefreitag in resend/resend-node#899

chore: bump 6.10.0 by @felipefreitag in resend/resend-node#900

New Contributors

@felipefreitag made their first contribution in resend/resend-node#899

Full Changelog: resend/resend-node@v6.9.4...v6.10.0

Commits

0d8923c chore: bump 6.10.0 (#900)
c643cf2 feat: support logs endpoints (#899)
ed788b1 chore(ci): pin GitHub Actions workflows to commit SHAs (#889)
e0c0b15 chore(deps): update dependency @types/node to v24.12.0 (#869)
f86ff17 feat(ci): split script and workflow for e2e test (#887)
264bfde fix(deps): update dependency svix to v1.88.0 (#873)
bd8fd85 chore(deps): update tj-actions/changed-files digest to 445b0eb (#870)
ca968c7 chore(deps): update dependency tsdown to v0.21.4 (#872)
b64ba52 chore(deps): update pnpm to v10.32.1 (#871)
440843d fix(deps): update dependency next to v16.2.0 (#882)
Additional commits viewable in compare view

dependabot · 2026-04-01T20:46:36Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

vercel · 2026-04-01T20:46:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
unicon	Ready	Preview, Comment	Apr 5, 2026 7:27pm

charlesrhoward · 2026-04-05T18:59:29Z

@dependabot rebase

charlesrhoward · 2026-04-05T19:22:47Z

@dependabot rebase

Bumps the production-minor group with 5 updates: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.27.1` | `1.29.0` | | [@opentelemetry/sdk-trace-node](https://github.com/open-telemetry/opentelemetry-js) | `2.6.0` | `2.6.1` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.45.0` | `10.47.0` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.1` | `0.45.2` | | [resend](https://github.com/resend/resend-node) | `6.9.4` | `6.10.0` | Updates `@modelcontextprotocol/sdk` from 1.27.1 to 1.29.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.27.1...v1.29.0) Updates `@opentelemetry/sdk-trace-node` from 2.6.0 to 2.6.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.6.0...v2.6.1) Updates `@sentry/nextjs` from 10.45.0 to 10.47.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.45.0...10.47.0) Updates `drizzle-orm` from 0.45.1 to 0.45.2 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.1...0.45.2) Updates `resend` from 6.9.4 to 6.10.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Commits](resend/resend-node@v6.9.4...v6.10.0) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor - dependency-name: "@sentry/nextjs" dependency-version: 10.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor - dependency-name: drizzle-orm dependency-version: 0.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor - dependency-name: resend dependency-version: 6.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor ... Signed-off-by: dependabot[bot] <support@github.com>

vercel bot deployed to Preview April 1, 2026 20:48 View deployment

charlesrhoward enabled auto-merge (squash) April 5, 2026 18:55

dependabot bot changed the title ~~chore(deps): bump the production-minor group with 5 updates~~ chore(deps): bump the production-minor group across 1 directory with 5 updates Apr 5, 2026

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from 6a2dee9 to f113739 Compare April 5, 2026 19:00

vercel bot deployed to Preview April 5, 2026 19:02 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from f113739 to 519b146 Compare April 5, 2026 19:04

vercel bot deployed to Preview April 5, 2026 19:06 View deployment

charlesrhoward mentioned this pull request Apr 5, 2026

chore: batch dependency updates #143

Closed

3 tasks

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from 519b146 to 8ca8a7e Compare April 5, 2026 19:08

vercel bot deployed to Preview April 5, 2026 19:09 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from 8ca8a7e to d2507ca Compare April 5, 2026 19:11

vercel bot deployed to Preview April 5, 2026 19:12 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from d2507ca to d3c96f1 Compare April 5, 2026 19:15

vercel bot deployed to Preview April 5, 2026 19:17 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from d3c96f1 to 4b066f5 Compare April 5, 2026 19:20

vercel bot deployed to Preview April 5, 2026 19:22 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/production-minor-6c16df1775 branch from 4b066f5 to 319662e Compare April 5, 2026 19:26

vercel bot deployed to Preview April 5, 2026 19:27 View deployment

charlesrhoward merged commit 7cbd90d into main Apr 5, 2026
6 checks passed

charlesrhoward deleted the dependabot/npm_and_yarn/production-minor-6c16df1775 branch April 5, 2026 19:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the production-minor group across 1 directory with 5 updates#137

chore(deps): bump the production-minor group across 1 directory with 5 updates#137
charlesrhoward merged 1 commit intomainfrom
dependabot/npm_and_yarn/production-minor-6c16df1775

dependabot bot commented on behalf of github Apr 1, 2026 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Apr 1, 2026

Uh oh!

vercel bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

charlesrhoward commented Apr 5, 2026

Uh oh!

charlesrhoward commented Apr 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.29.0

What's Changed

New Contributors

v1.28.0

What's Changed

New Contributors

v2.6.1

2.6.1

🐛 Bug Fixes

🏠 Internal

2.6.1

🐛 Bug Fixes

🏠 Internal

10.47.0

Important Changes

10.47.0

Important Changes

0.45.2

v6.10.0

What's Changed

New Contributors

Uh oh!

dependabot bot commented on behalf of github Apr 1, 2026

Labels

Uh oh!

vercel bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

charlesrhoward commented Apr 5, 2026

Uh oh!

charlesrhoward commented Apr 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Apr 1, 2026 •

edited

Loading

vercel bot commented Apr 1, 2026 •

edited

Loading