chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

[dependabot]

Bumps @modelcontextprotocol/sdk from 1.29.0 to 1.30.0.

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in modelcontextprotocol/typescript-sdk#1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in modelcontextprotocol/typescript-sdk#1839
• Add end-to-end test suite by @​felixweinberger in modelcontextprotocol/typescript-sdk#2167
• v1 stdio buffer limit by @​KKonstantinov in modelcontextprotocol/typescript-sdk#2239
• fix: support Zod 3.25 method literals by @​mattzcarey in modelcontextprotocol/typescript-sdk#2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in modelcontextprotocol/typescript-sdk#2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in modelcontextprotocol/typescript-sdk#2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2547
• chore: bump version to 1.30.0 by @​felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

• @​mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503
• @​arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

• 2d889f2 chore: bump version to 1.30.0 (#2563)
• e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
• bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
• 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
• 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
• 369513d fix: support Zod 3.25 method literals (#2368)
• e7ee57c v1 stdio buffer limit (#2239)
• c36e1ef Add end-to-end test suite (#2167)
• bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
• 9edbab7 fix(server): prioritize zod issues and format them (#1503)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

g0 security scan

Score 55/100 (F)

Severity	Count
Critical	6
High	48
Medium	9
Low	1

Findings

• CRITICAL /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:226 — Docker socket mounted into container — full container escape possible. Address AA-SC-130: Docker socket mounted into container — full container escape possible
• CRITICAL analyzers/pipeline-taint.ts:4 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• CRITICAL .:0 — Cross-tool risk: fetch-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: db-code-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: write-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: shell-network. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH analyzers/parsers/mcp.ts:102 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:52 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:54 — Database tool without input validation. Use parameterized queries and validate all input before database operations.
• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).

55 more findings

• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH testing/payloads/openclaw-attacks.ts:66 — OpenAI API key detected in source code. Move secrets to environment variables or a secret manager. Never commit secrets to source code.
• HIGH analyzers/rules/code-execution.ts:163 — new Function() constructor used. Remove new Function() usage. Use safe alternatives.
• HIGH analyzers/rules/code-execution.ts:440 — child_process.exec() usage detected. Use child_process.execFile() or child_process.spawn() instead of exec/execSync to avoid shell injection.
• HIGH analyzers/parsers/langchain.ts:177 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/parsers/mcp.ts:145 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/rules/code-execution.ts:804 — Unsandboxed Docker socket access. Avoid mounting the Docker socket directly. Use a restricted Docker API proxy or rootless Docker.
• HIGH analyzers/rules/code-execution.ts:167 — Function() constructor with dynamic input. Avoid new Function() with dynamic input. Use safe alternatives or a sandboxed environment.
• HIGH analyzers/rules/code-execution.ts:980 — Template engine SSTI risk. Never pass user input directly into template strings. Use render_template() with named templates instead.
• HIGH analyzers/rules/code-execution.ts:1840 — ptrace/debugging syscall detected. Block ptrace and debugging syscalls via seccomp profiles. Set Yama ptrace_scope to restricted.
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:85 — LLM-generated code execution. Sandbox code execution or use allowlisted operations only
• HIGH /home/runner/work/g0/g0/src/endpoint/agentic-browser-scanner.ts:61 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:10 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:56 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/process-detector.ts:75 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — All environment variables dumped — credential exposure. Address AA-DL-109: All environment variables dumped — credential exposure
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:41 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:63 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:80 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:97 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:114 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:131 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:146 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:161 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:179 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/auditd-rules.ts:55 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:63 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:70 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:570 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:637 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:210 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:369 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:513 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:544 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:545 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH analyzers/parsers/langchain.ts:666 — System prompt has no scope boundaries. Add explicit role definition, allowed actions, and behavioral boundaries to the system prompt.
• HIGH analyzers/rules/tool-safety.ts:1074 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH endpoint/tetragon-rules.ts:372 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH .:0 — Cross-tool risk: read-then-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH .:0 — Cross-tool risk: db-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:128 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• MEDIUM /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:734 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• MEDIUM analyzers/parsers/langchain.ts:55 — Filesystem tool without path validation. Validate and sanitize file paths. Use allowlists for permitted directories.
• MEDIUM enforcement/edm.ts:23 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM testing/judge/llm-prompts.ts:69 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/sensitive-paths.ts:60 — Untrusted input flows to file path operation — path traversal risk. Address AA-CE-052: Untrusted input flows to file path operation — path traversal risk
• MEDIUM /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — Agent accesses environment variables. Address AA-RA-043: Agent accesses environment variables
• MEDIUM /home/runner/work/g0/g0/src/endpoint/agent-config-scanner.ts:257 — Tool has email sending capability — phishing and data exfiltration risk. Address AA-TS-105: Tool has email sending capability — phishing and data exfiltration risk
• MEDIUM analyzers/parsers/langchain.ts:56 — Tool has unrestricted network access. Address AA-TS-062: Tool has unrestricted network access
• LOW analyzers/parsers/langchain.ts:204 — Agent has no system prompt — vulnerable to unbounded behavior. Address AA-GI-073: Agent has no system prompt — vulnerable to unbounded behavior
• INFO analyzers/parsers/langchain.ts:204 — Agent has no error handler configured. Address AA-CF-064: Agent has no error handler configured

Gate: PASSED ✅

— See findings across every repo in your org → https://guard0.ai/signup?utm_source=github&utm_medium=pr_comment&utm_campaign=g0_action