[kpal81xd]

A manual pass that follows renovate.json: all npm dependencies in one group, pinned to exact versions, non-major updates only. The GitHub Actions in use are already on their latest majors (checkout v7, setup-node v7, action-gh-release v3), so nothing changes there.

Updates

Package	From	To
@modelcontextprotocol/sdk	1.25.2	1.32.1
ws	^8.19.0	8.22.0
eslint	^9.39.2	9.39.5
publint	^0.3.16	0.3.25
@types/node	^22.18.0	22.20.5
@types/ws	^8.18.1	8.18.2

The other dev dependencies are pinned at their current versions. npm audit fix (without --force) then moved transitive versions in the lockfile, so npm audit goes from 20 findings on main to 0.

SDK note

SDK 1.32.1 fixes GHSA-6qxp-vccf-f47h. That advisory is in the OAuth client, which this stdio server doesn't import, but 1.25.2 was flagged for it.

SDK 1.29+ maps its ./* wildcard types to *.js.d.ts files it doesn't ship. That breaks ESLint's import-x/no-unresolved for @modelcontextprotocol/sdk/server/mcp.js and similar imports. Node, tsc and esbuild still resolve them. eslint.config.mjs therefore ignores only ^@modelcontextprotocol/sdk/ for that rule. I checked that a missing local import is still reported.

Verification

• Lint, build, the 26 tests and publint pass.
• tsc --noEmit reports the same 2 errors as main. Both predate this change, and tsc isn't part of CI.
• The packed server's tools/list output is byte-identical to main: 125 tools, 168,274 characters.
• The bundle grows from 1.26 MB to 1.29 MB.

Majors held for separate review

• @modelcontextprotocol/inspector 0.22 → 2.10: dev-only debugger, but a major API and CLI change.
• typescript 5.9 → 7.0: the native compiler port.
• zod 3 → 4: bundled, so it changes how tool schemas are generated.
• esbuild 0.25 → 0.28: minor bumps on 0.x can break, and it produces the published bundle.
• @types/node 22 → 26: engines is >=22.18, so this stays on 22. renovate.json now limits @types/node to 22.x, so Renovate won't propose newer majors.

Smoke test

1. Check out chore/deps, then run npm install and npm run watch. Connect the Editor on port 52000. It shows connected.
2. From your MCP client, run list_entities and then capture_viewport. They return the scene's entities and a screenshot, as on main.