@mastra/mcp 1.10.0 → 1.10.1-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @mastra/mcp
 
+## 1.10.1-alpha.0
+
+### Patch Changes
+
+- Security remediation for the 2026-06-17 "easy-day-js" supply-chain incident. Patch bump to publish clean versions and move the `latest` dist-tag forward, superseding the compromised versions that declared the malicious `easy-day-js` dependency. ([#18056](https://github.com/mastra-ai/mastra/pull/18056))
+
+- Updated dependencies [[`77a2351`](https://github.com/mastra-ai/mastra/commit/77a2351ee79296e360bce822cb3391f7cfd6489d)]:
+  - @mastra/core@1.43.1-alpha.0
+
 ## 1.10.0
 
 ### Minor Changes

package/dist/_types/hono/dist/types/request.d.ts

@@ -164,6 +164,19 @@ export declare class HonoRequest<P extends string = '/', I extends Input['out']
      * ```
      */
     arrayBuffer(): Promise<ArrayBuffer>;
+    /**
+     * `.bytes()` parses the request body as a `Uint8Array`.
+     *
+     * @see {@link https://hono.dev/docs/api/request#bytes}
+     *
+     * @example
+     * ```ts
+     * app.post('/entry', async (c) => {
+     *   const body = await c.req.bytes()
+     * })
+     * ```
+     */
+    bytes(): Promise<Uint8Array>;
     /**
      * Parses the request body as a `Blob`.
      * @example

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-mcp
 description: Documentation for @mastra/mcp. Use when working with @mastra/mcp APIs, configuration, or implementation.
 metadata:
   package: "@mastra/mcp"
-  version: "1.10.0"
+  version: "1.10.1-alpha.0"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.10.0",
+  "version": "1.10.1-alpha.0",
   "package": "@mastra/mcp",
   "exports": {
     "UnauthorizedError": {

package/dist/index.cjs

@@ -2357,7 +2357,7 @@ function createSimpleTokenProvider(accessToken, options) {
   });
 }
 
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.18/a4592d669eb2c33e4f24995614864047f2c1a155accc9d64dd2de0f4e8d608a9/node_modules/hono/dist/utils/stream.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.21/c401a6c1b505d0adf80740e6e7d31122a2ebd9abaf1de7e5dee418ae2a608e7a/node_modules/hono/dist/utils/stream.js
 var StreamingApi = class {
   writer;
   encoder;
@@ -2386,7 +2386,9 @@ var StreamingApi = class {
         done ? controller.close() : controller.enqueue(value);
       },
       cancel: () => {
-        this.abort();
+        if (!this.closed) {
+          this.abort();
+        }
       }
     });
   }
@@ -2408,11 +2410,11 @@ var StreamingApi = class {
     return new Promise((res) => setTimeout(res, ms));
   }
   async close() {
+    this.closed = true;
     try {
       await this.writer.close();
     } catch {
     }
-    this.closed = true;
   }
   async pipe(body) {
     this.writer.releaseLock();
@@ -2434,7 +2436,7 @@ var StreamingApi = class {
   }
 };
 
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.18/a4592d669eb2c33e4f24995614864047f2c1a155accc9d64dd2de0f4e8d608a9/node_modules/hono/dist/helper/streaming/utils.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.21/c401a6c1b505d0adf80740e6e7d31122a2ebd9abaf1de7e5dee418ae2a608e7a/node_modules/hono/dist/helper/streaming/utils.js
 var isOldBunVersion = () => {
   const version = typeof Bun !== "undefined" ? Bun.version : void 0;
   if (version === void 0) {
@@ -2445,7 +2447,7 @@ var isOldBunVersion = () => {
   return result;
 };
 
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.18/a4592d669eb2c33e4f24995614864047f2c1a155accc9d64dd2de0f4e8d608a9/node_modules/hono/dist/utils/html.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.21/c401a6c1b505d0adf80740e6e7d31122a2ebd9abaf1de7e5dee418ae2a608e7a/node_modules/hono/dist/utils/html.js
 var HtmlEscapedCallbackPhase = {
   Stringify: 1};
 var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) => {
@@ -2476,7 +2478,7 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) =>
   }
 };
 
-// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.18/a4592d669eb2c33e4f24995614864047f2c1a155accc9d64dd2de0f4e8d608a9/node_modules/hono/dist/helper/streaming/sse.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono/4.12.21/c401a6c1b505d0adf80740e6e7d31122a2ebd9abaf1de7e5dee418ae2a608e7a/node_modules/hono/dist/helper/streaming/sse.js
 var SSEStreamingApi = class extends StreamingApi {
   constructor(writable, readable) {
     super(writable, readable);
@@ -3363,7 +3365,7 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
         const resource = resources.find((r) => r.uri === uri);
         if (!resource) {
           this.logger.warn("Unknown resource URI requested", { uri });
-          throw new Error(`Resource not found: ${uri}`);
+          throw new types_js.McpError(types_js.ErrorCode.InvalidParams, `Resource not found: ${uri}`);
         }
         try {
           const resourcesOrResourceContent = await capturedResourceOptions.getResourceContent({ uri, extra });
@@ -3472,7 +3474,7 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
           if (prompt.arguments) {
             for (const arg of prompt.arguments) {
               if (arg.required && (args?.[arg.name] === void 0 || args?.[arg.name] === null)) {
-                throw new Error(`Missing required argument: ${arg.name}`);
+                throw new types_js.McpError(types_js.ErrorCode.InvalidParams, `Missing required argument: ${arg.name}`);
               }
             }
           }