[dependabot]

Bumps the sdk group with 1 update: @modelcontextprotocol/sdk.

Updates @modelcontextprotocol/sdk from 1.32.1 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @​kishormorol in modelcontextprotocol/typescript-sdk#2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in modelcontextprotocol/typescript-sdk#2958
• chore: bump version to 1.32.2 by @​claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

• @​kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Commits

• 3b73021 chore: bump version to 1.32.2 (#3089)
• fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
• 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 49s —— View job

---

Dependency review — @modelcontextprotocol/sdk 1.32.1 → 1.32.2

• Inspect the diff and confirm the version range
• Read the 1.32.2 release notes for behaviour changes
• Check how @modelcontextprotocol/sdk is used in this repo
• Check CI results

Verdict: safe to merge. No changes needed.

What changed

Patch bump, no major or minor crossing. The diff touches only package-lock.json (version, resolved, integrity) — package.json keeps its ^1.29.0 range, as expected for a lockfile-only update, and no transitive dependency moved.

Two fixes in 1.32.2:

1. fix: add explicit | undefined to Transport optional properties (#2814) — a type-only widening that matters to code assigning undefined to optional Transport members under exactOptionalPropertyTypes. That flag isn't set in tsconfig.json (strict: true doesn't imply it), and nothing here implements Transport — src/index.ts:8, test/server.test.ts:22 and scripts/smoke.ts:60 only construct the SDK's own StdioServerTransport / InMemoryTransport / StdioClientTransport. No impact.
2. fix: allow registering after connect() when the capability was declared (#2958) — a loosening, not a tightening. createServer (src/server.ts) registers all three tools and returns before src/index.ts:8 calls connect(), so the previously-stricter path was never hit. No impact on tool registration or the readOnlyHint / destructiveHint annotations that drive the read/write split.

Neither release note mentions deprecations or behaviour changes in registerTool, annotations, or the stdio transport.

CI

test (node 22.12) and test (node 24) both pass — that job covers build, typecheck, tests, smoke against dist/, the .mcpb pack + mcpb validate, and the bundle smoke test, so the SDK's new type definitions compile against strict: true and the server still starts over real stdio. CodeQL Analyze legs were still pending when I looked; worth a glance before merge, though a lockfile bump is unlikely to move them.

No follow-up checks or extra tests suggested — test/server.test.ts already drives the real tools over InMemoryTransport, which is the coverage that would catch a registration regression from change (2).
· Branch