fix: bump incur to fix downstream dep

[o-az]

tl;dr

npx --yes curl.md@latest --version

file:///Users/o/.npm/_npx/cd079c9f8cb86f54/node_modules/incur/dist/Mcp.js:1
import { McpServer, StdioServerTransport } from '@modelcontextprotocol/server';
                    ^^^^^^^^^^^^^^^^^^^^
SyntaxError: The requested module '@modelcontextprotocol/server' does not provide an export named 'StdioServerTransport'
    at #asyncInstantiate (node:internal/modules/esm/module_job:326:21)
    at async ModuleJob.run (node:internal/modules/esm/module_job:429:5)
    at async node:internal/modules/esm/loader:639:26
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)

Last working version is curl.md@0.0.13:

npx --yes curl.md@0.0.13 --version

0.0.13

Cause: curl.md -> incur -> @modelcontextprotocol/sdk breaking API change. Fix: bump incur.

curl.md@0.0.13 pinned incur@0.3.20, which depended on @modelcontextprotocol/sdk@^1.27.1 (the v1 SDK).
0.0.14 bumped to incur@0.3.23, which switched its dependency to @modelcontextprotocol/server@^2.0.0-alpha.2 (the new v2 package).

incur@0.3.23's dist/Mcp.js:1 statically imports StdioServerTransport from the package root: import { McpServer, StdioServerTransport } from '@modelcontextprotocol/server'. The ^2.0.0-alpha.2 range floats to the newest prerelease, which today resolves to 2.0.0-beta.2. In 2.0.0-alpha.4 (Jun 30), @modelcontextprotocol/server moved StdioServerTransport out of the root export into a ./stdio subpath, so the static root import throws SyntaxError: ... does not provide an export named 'StdioServerTransport'. The fix: bump incur to 0.4.11, which replaced the static root import with a dynamic import('@modelcontextprotocol/server') plus importModule('@modelcontextprotocol/server/stdio') in dist/Mcp.js.

[pkg-pr-new]

Open in StackBlitz

curl.md

npm i https://pkg.pr.new/curl.md@84

@curl.md/amp

npm i https://pkg.pr.new/@curl.md/amp@84

@curl.md/claude

npm i https://pkg.pr.new/@curl.md/claude@84

@curl.md/opencode

npm i https://pkg.pr.new/@curl.md/opencode@84

@curl.md/pi

npm i https://pkg.pr.new/@curl.md/pi@84

commit: bbfeaf6

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	incur@​0.4.11

View full report

[github-actions]

The latest preview deployment for bbfeaf6

Name	Status	Preview	Updated (UTC)
pr84	Error	pr84.curl.md	Jul 8, 2026, 1:08 AM

Services

• Cloudflare
• PlanetScale
• Stripe