Skip to content

Conversation

@Bronx83
Copy link
Contributor

@Bronx83 Bronx83 commented Dec 10, 2025

What?

Upgrades @modelcontextprotocol/sdk from ^1.20.2 to ^1.24.0 in the TypeScript SDK's devDependencies.

Why?

Related to #7737 - keeping development dependencies up to date with the latest MCP SDK version that includes the fix for CVE-2025-66414.

Note: This change does not address the CVE for Codex users, as the MCP SDK is only in devDependencies here. The actual MCP integration that would be affected by the CVE is in the Rust codebase.

How?

• Updated dependency version in sdk/typescript/package.json
• Ran pnpm install to update lockfile
• Fixed formatting (added missing newline in package.json)

Related Issue

Related to #7737

Test Status

⚠️ After this upgrade, 2 additional tests timeout (1 test was already failing on main):
• tests/run.test.ts: "sends previous items when run is called twice"
• tests/run.test.ts: "resumes thread by id"
• tests/runStreamed.test.ts: "sends previous items when runStreamed is called twice"

Marking as draft to investigate test timeouts. Maintainer guidance would be appreciated.

@github-actions
Copy link


Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.


I have read the CLA Document and I hereby sign the CLA


You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

@Bronx83 Bronx83 marked this pull request as draft December 10, 2025 12:19
@Bronx83
Copy link
Contributor Author

Bronx83 commented Dec 10, 2025

I have read the CLA Document and I hereby sign the CLA

@Bronx83
Copy link
Contributor Author

Bronx83 commented Dec 10, 2025

recheck

@etraut-openai etraut-openai marked this pull request as ready for review December 10, 2025 18:16
@etraut-openai
Copy link
Collaborator

Thanks for the contribution.

@etraut-openai etraut-openai merged commit bd51d1b into openai:main Dec 10, 2025
11 of 12 checks passed
@github-actions github-actions bot locked and limited conversation to collaborators Dec 10, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants