chore(deps): update dependency @modelcontextprotocol/ext-apps to v1.7.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/ext-apps	1.1.0 → 1.7.0

---

Release Notes

modelcontextprotocol/ext-apps (@​modelcontextprotocol/ext-apps)

v1.7.0: 1.7.0

Compare Source

Changes since 1.6.0

Features

• App.registerTool() / sendToolListChanged() — Views can expose tools for the Host to call (WebMCP-style) (#​72)
• App.createSamplingMessage() — sampling support via stock SDK types (#​530)
• Handshake-ordering guards (console.warn, or throw with AppOptions.strict): App host-bound methods warn when called before connect() completes; one-shot event handlers (ontoolinput/ontoolresult/etc.) warn when first registered after connect(); AppBridge warns when it receives requests before ui/notifications/initialized (#​623, #​629, #​625, #​630, #​631)
• AppOptions.allowUnsafeEval (default false) — App constructor sets z.config({ jitless: true }) so Views run under strict CSP without unsafe-eval; opt out for the faster JIT path (#​618)
• useApp() forwards autoResize and strict to the underlying App (#​622)

Fixes

• useApp effect cleanup now closes the App, so React StrictMode's dev double-invoke doesn't leave a zombie PostMessageTransport listener receiving every host message alongside the live instance (#​631)
• csp / permissions typed ?: never on McpUiToolMeta so misplaced declarations fail at compile time (#​624)
• Drop stale resourceUri JSDoc that referenced the deprecated flat _meta["ui/resourceUri"] key (#​626)

Chore

• npm run bump script for version bumps across root + workspaces; npm-publish jobs now approve in a single click; prereleases publish under --tag beta (#​568)
• Pre-commit hook: skip link-self when target is a symlink; --diff-filter=d so re-stage doesn't fail on deletions (#​621)
• Bump vite / hono / @​hono/node-server to patched versions (#​616)
• Examples policy added to CONTRIBUTING.md (#​550)

v1.6.0: 1.6.0

Compare Source

What's Changed

• test(e2e): poll for initial shrink-to-fit zoom before asserting by @​ochafik in #​607
• callServerTool: opt into progress-based timeout reset by @​anthroy in #​600
• chore: bump ext-apps to 1.6.0 by @​ochafik in #​613

Full Changelog: modelcontextprotocol/ext-apps@v1.5.0...v1.6.0

v1.5.0: 1.5.0

Compare Source

What's Changed

• fix(pdf-server): translucent highlights, pinch to/from fullscreen, toolbar layout by @​ochafik in #​587
• fix(pdf-server): let zoom-out button go below fit-to-page by @​ochafik in #​589
• feat(pdf-server): get_viewer_state interact action by @​ochafik in #​590
• fix(pdf-server): import highlight/underline/strike from existing PDFs by @​ochafik in #​592
• fix(pdf-server): form-field save robustness by @​ochafik in #​591
• feat(pdf-server): rasterize imported annotations + form/save consistency follow-ups by @​ochafik in #​593

Full Changelog: modelcontextprotocol/ext-apps@v1.4.0...v1.5.0

v1.4.0: 1.4.0

Compare Source

Changes since 1.3.2:

SDK

• feat: add addEventListener/removeEventListener with DOM-model on* semantics (#​573)

pdf-server

• feat: add save_as interact action (#​580)
• feat: fit-to-page on fullscreen + pinch-to-zoom (#​583)
• fix: npx DOMMatrix crash + broken MCPB bundle (#​584)
• fix: viewer liveness, 1:1 batch results, fullscreen jitter (#​579)
• fix: render page before O(numPages) annotation scans (#​581)
• fix: radio + dropdown in fill_form/save (#​577)

Dependencies

• chore: npm audit fix — sdk 1.29.0, systeminformation 5.31.5, +13 transitives (#​585, #​586)
• fix: bump path-to-regexp 8.3.0 → 8.4.1 to patch ReDoS CVEs (#​576)

v1.3.2: 1.3.2

Compare Source

What's Changed

• Remove examples/pdf-server/plugin/ — canonical copy is upcoming in knowledge-work-plugins by @​ochafik in #​565
• Fix auto-resize destroying horizontal scroll positions by @​mel-anthropic in #​567
  • Revert fullscreen size-changed skip by @​mel-anthropic in #​570
• chore: bump ext-apps to 1.3.2 by @​ochafik in #​569

Full Changelog: modelcontextprotocol/ext-apps@v1.3.1...v1.3.2

v1.3.1: 1.3.1

Compare Source

What's Changed

• fix(pdf-server): detached-buffer on range re-request + stale e2e assertion by @​ochafik in #​561
• chore: bump ext-apps to 1.3.1 by @​ochafik in #​562

Full Changelog: modelcontextprotocol/ext-apps@v1.3.0...v1.3.1

v1.3.0: 1.3.0

Compare Source

What's Changed

• fix(examples): improve mobile support for map, pdf, and threejs examples by @​mel-anthropic in #​555
• pdf-server: annotations, interact tool, page extraction & prompt engineering by @​ochafik in #​506
• Add ui/notifications/request-close notification for UI to initiate termination by @​fredericbarthelet in #​215
• chore: bump ext-apps to 1.3.0 by @​ochafik in #​560

Full Changelog: modelcontextprotocol/ext-apps@v1.2.2...v1.3.0

v1.2.2: 1.2.2

Compare Source

What's Changed

• fix(schemas): import from zod/v4 to match SDK's zod API by @​ochafik in #​548
• chore: bump ext-apps to 1.2.2 by @​ochafik in #​549

Full Changelog: modelcontextprotocol/ext-apps@v1.2.1...v1.2.2

v1.2.1: 1.2.1

Compare Source

What's Changed

• test: exclude screenshot-gen from default E2E run; wire pdf-server tests by @​ochafik in #​537
• fix(build): copy schema.json to dist and externalize zod by @​ochafik in #​534
• ci: use npm ci with caching, validate typedoc links, align Node versions by @​ochafik in #​533
• fix: pre-commit stages only originally-staged files; add .npmrc by @​ochafik in #​538
• fix(deps): drop @​hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 by @​ochafik in #​535
• fix(ci): require maintainer association for /update-snapshots trigger by @​ochafik in #​532
• fix: skip debug log for high-frequency tool-input-partial notifications by @​antonpk1 in #​546
• fix: theme-aware README logo + docs preview CI by @​localden in #​545
• fix: bundle SDK+zod in react-with-deps (was byte-identical to ./react) by @​ochafik in #​539
• test(e2e): fix no-op security injection test via frames[] traversal by @​ochafik in #​540
• chore: bump ext-apps to 1.2.1 by @​ochafik in #​547

Full Changelog: modelcontextprotocol/ext-apps@v1.2.0...v1.2.1

v1.2.0: 1.2.0

Compare Source

Changes since 1.1.2:

Features

• feat: add readServerResource() and listServerResources() API to App (#​470, #​528)

Fixes

• fix: replace platform-specific optionalDependencies with bun devDependency (#​518)
• fix: autoResize reporting viewport height when content is taller (#​525)
• fix: remove duplicate --color-text-ghost from McpUiStyleVariableKey (#​523)
• fix: examples servers' npm run start:stdio (#​507)
• fix: work around tsx watch hang on Windows in quickstart (#​428)

Refactors

• refactor: remove unnecessary type assertions (#​471)
• refactor: replace deprecated RESOURCE_URI_META_KEY with modern format (#​457)

Examples & Plugin

• pdf-server: ignore client roots by default (#​510)
• plugin: refactor create-mcp-app skill to reference patterns.md (#​416)

Docs

• docs: add Security documentation section and SEO improvements (#​524)
• docs: add MCP client configuration examples to CONTRIBUTING.md (#​508, #​526)
• docs: use apps.extensions.modelcontextprotocol.io domain for docs URLs (#​499)
• docs: add SECURITY.md with GitHub Security Advisories guidance (#​472)

Full Changelog: modelcontextprotocol/ext-apps@v1.1.2...v1.2.0

v1.1.2: 1.1.2

Compare Source

What's Changed

• pdf-server: robust path validation + folder/file root support by @​ochafik in #​497
• feat: add ui/download-file method for host-mediated file downloads by @​antonpk1 in #​475
• ci: auto-fix prettier formatting in pre-commit hook and CI by @​ochafik in #​498
• fix: sync local SDK build into node_modules for examples by @​ochafik in #​504
• chore: bump ext-apps to 1.1.2 by @​ochafik in #​503

Full Changelog: modelcontextprotocol/ext-apps@v1.1.1...v1.1.2

v1.1.1: 1.1.1

Compare Source

What's Changed

• fix: add audio/video support for basic-host by @​Avcharov in #​460
• Adding ChatGPT to the readme by @​conorkel in #​486
• fix(pdf-server): remove page-loading overlay by @​ochafik in #​493
• pdf-server: remove domain allowlist, require HTTPS only by @​ochafik in #​487
• ci: add missing examples to deploy workflows by @​ochafik in #​494
• Add MCPB packaging and Claude Code plugin for pdf-server by @​bryan-anthropic in #​491
• ci: build and publish MCPB bundle for pdf-server by @​ochafik in #​495
• Set audioSession.type to playback in sheet music app by @​mel-anthropic in #​489
• chore: bump ext-apps to 1.1.1 by @​ochafik in #​496

Full Changelog: modelcontextprotocol/ext-apps@v1.1.0...v1.1.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.