Triage 7 non-Node-20 dependabot PRs (typescript, vitest, @types/node, MCP SDK bumps) #33

Activity

1. TMHSDigital

   added

   enhancementNew feature or requestNew feature or request

   on Apr 25, 2026
2. TMHSDigital commented on Apr 25, 2026

   

   TMHSDigital

   on Apr 25, 2026

   OwnerAuthor

   More actions

   Triage results from 2026-04-25:

   Safe-merged (5 PRs, patch/minor/types):

   • Docker Phase 3: semantic drift detection (principle wording, contradictions) #17: @types/node 25.5.0 -> 25.6.0 (types only, minor) -> 514627f
   • Docker Node 20 deprecation: bump actions/setup-python and other Node 20 actions before 2026-06-02 #18: vitest 4.1.2 -> 4.1.4 (patch within v4) -> 9ad5633
   • Docker fix: release-doc-sync action checkout pollutes caller's working tree #20: typescript 6.0.2 -> 6.0.3 (patch within v6, post-rebase) -> bb0dfae
   • Home-Lab chore: finish Phase 1 with standards template and scaffold updates #6: @types/node 25.5.2 -> 25.6.0 (types only, minor) -> 3925af5
   • Home-Lab feat: drift checker additional checks and policy data (Phase 2 Session B) #8: vitest 4.1.2 -> 4.1.4 (patch within v4) -> 623c867

   Reviewed and merged (1 PR, major bump with green relevant CI):

   • Home-Lab Ecosystem drift report (live) #10: typescript 5.9.3 -> 6.0.3 (MAJOR 5 -> 6, post-rebase) -> 8a96c15
     • Relevant CI checks (typecheck, test, lint) all green
     • Only failing check was the pre-existing "Auto-label by path" workflow, which is unrelated to the bump

   Deferred for manual review (1 PR):

   • Docker stale-counts findings in SKILL.md files (Home-Lab, Steam) need investigation #13: @modelcontextprotocol/sdk 1.28.0 -> 1.29.0
     • The meta-repo's MCP servers depend on stable SDK behavior; minor bumps in this dependency warrant a dedicated investigation session before merging
     • PR's CI is green, but the version delta may include behavior changes worth verifying against the upstream changelog
     • Comment posted on the PR noting the deferral

   This issue stays OPEN as a tracker for Docker #13. Once that PR is reviewed and merged (or closed), this issue can be closed.

   Note on Docker #20 and Home-Lab #10: both required @dependabot rebase after their sibling vitest PRs landed (package-lock.json conflicts). Both rebased cleanly and merged.
3. TMHSDigital commented on Apr 25, 2026

   

   TMHSDigital

   on Apr 25, 2026

   OwnerAuthor

   More actions

   All 7 originally-deferred PRs from DTD#18 work are now processed. Final PR (Docker #13, @modelcontextprotocol/sdk 1.28.0 -> 1.29.0) merged 2026-04-25 after compatibility review.

   SDK usage audit: Docker's mcp-server uses only McpServer (from @modelcontextprotocol/sdk/server/mcp.js) and StdioServerTransport (from @modelcontextprotocol/sdk/server/stdio.js). All 95+ tool files import only the McpServer type.

   1.29.0 changelog vs Docker usage:

   • Backports/additive: ResourceSchema size field, typings exports, capability extensions, windowsHide always-on for stdio child processes (not relevant to server-side Stdio transport), npm audit fix.
   • Single behavior change of note: disallow null (infinite) requested TTL (#1339). Docker does not call any TTL-bearing API; not applicable.

   CI: All checks pass (CodeQL, Socket Security, build-and-test 20/22, dependency-review, validate, update-release-draft).

   Closing DTD#33. Backlog from DTD#18 work is fully drained.
4. TMHSDigital

   closed this as completedon Apr 25, 2026