mcp-from-openapi 2.7.0 → 2.8.0

package/esm/index.mjs

@@ -2983,6 +2983,8 @@ function nodePinnedTransport(modules) {
     const requestOptions = {
       method: "GET",
       signal,
+      // A pooled keep-alive socket is keyed by host:port only and would skip the pinned lookup.
+      agent: false,
       headers: { ...headers, "accept-encoding": "identity" }
     };
     if (pinned.length > 0) {
@@ -5690,7 +5692,7 @@ function buildHttpRequest(tool, input, options = {}) {
         if (typeof Blob !== "undefined" && v instanceof Blob) {
           form.append(k, v);
         } else if (v instanceof Uint8Array) {
-          form.append(k, new Blob([v]));
+          form.append(k, new Blob([new Uint8Array(v)]));
         } else if (isPlainObject(v) || Array.isArray(v)) {
           form.append(k, JSON.stringify(v));
         } else {

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-from-openapi",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "Production-ready library for converting OpenAPI specifications into MCP tool definitions",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -28,7 +28,7 @@
   },
   "homepage": "https://github.com/agentfront/mcp-from-openapi#readme",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.19.0"
   },
   "type": "module",
   "main": "../index.js",
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@apidevtools/json-schema-ref-parser": "^15.5.1",
+    "@apidevtools/json-schema-ref-parser": "^16.0.2",
     "openapi-types": "^12.1.3",
     "yaml": "^2.9.0"
   },
@@ -58,15 +58,15 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@swc/core": "~1.5.7",
+    "@swc/core": "~1.16.1",
     "@swc/helpers": "^0.5.18",
     "@swc/jest": "~0.2.38",
-    "@types/jest": "^29.5.0",
+    "@types/jest": "^30.0.0",
     "@types/json-schema": "^7.0.15",
-    "@types/node": "^24.0.0",
+    "@types/node": "^26.4.1",
     "ajv": "^8.17.0",
-    "esbuild": "^0.27.2",
-    "jest": "^29.7.0",
+    "esbuild": "^0.28.2",
+    "jest": "^30.5.1",
     "tslib": "^2.8.1",
     "typescript": "^5.0.0",
     "zod": "^4.0.0"

package/index.js

@@ -3071,6 +3071,8 @@ function nodePinnedTransport(modules) {
     const requestOptions = {
       method: "GET",
       signal,
+      // A pooled keep-alive socket is keyed by host:port only and would skip the pinned lookup.
+      agent: false,
       headers: { ...headers, "accept-encoding": "identity" }
     };
     if (pinned.length > 0) {
@@ -5778,7 +5780,7 @@ function buildHttpRequest(tool, input, options = {}) {
         if (typeof Blob !== "undefined" && v instanceof Blob) {
           form.append(k, v);
         } else if (v instanceof Uint8Array) {
-          form.append(k, new Blob([v]));
+          form.append(k, new Blob([new Uint8Array(v)]));
         } else if (isPlainObject(v) || Array.isArray(v)) {
           form.append(k, JSON.stringify(v));
         } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-from-openapi",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "Production-ready library for converting OpenAPI specifications into MCP tool definitions",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -28,7 +28,7 @@
   },
   "homepage": "https://github.com/agentfront/mcp-from-openapi#readme",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.19.0"
   },
   "type": "commonjs",
   "main": "./index.js",
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@apidevtools/json-schema-ref-parser": "^15.5.1",
+    "@apidevtools/json-schema-ref-parser": "^16.0.2",
     "openapi-types": "^12.1.3",
     "yaml": "^2.9.0"
   },
@@ -58,15 +58,15 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@swc/core": "~1.5.7",
+    "@swc/core": "~1.16.1",
     "@swc/helpers": "^0.5.18",
     "@swc/jest": "~0.2.38",
-    "@types/jest": "^29.5.0",
+    "@types/jest": "^30.0.0",
     "@types/json-schema": "^7.0.15",
-    "@types/node": "^24.0.0",
+    "@types/node": "^26.4.1",
     "ajv": "^8.17.0",
-    "esbuild": "^0.27.2",
-    "jest": "^29.7.0",
+    "esbuild": "^0.28.2",
+    "jest": "^30.5.1",
     "tslib": "^2.8.1",
     "typescript": "^5.0.0",
     "zod": "^4.0.0"

package/ssrf.d.ts

@@ -26,7 +26,8 @@
  *     guard and the socket share one DNS resolution. This closes the
  *     DNS-rebinding TOCTOU where the client would otherwise re-resolve the
  *     hostname at connect time and reach a different (internal) address. The
- *     original hostname is preserved for the `Host` header and TLS SNI;
+ *     original hostname is preserved for the `Host` header and TLS SNI, and
+ *     every request opens a fresh socket (never a pooled keep-alive one);
  *   - re-validates every redirect hop ({@link safeFetch}) instead of letting the
  *     HTTP client follow 3xx blindly.
  *
@@ -154,8 +155,9 @@ export declare function makePinnedLookup(pinned: ResolvedAddress[]): (_hostname:
 /**
  * Node transport that pins the connection to the validated address(es) via a
  * custom `lookup`, preserving the original hostname for the `Host` header and
- * TLS SNI. Manual redirects only (no `lookup` re-resolution between hops).
- * Exported for tests.
+ * TLS SNI. Each request uses a one-off agent so a shared keep-alive pool can't
+ * hand it a socket connected elsewhere. Manual redirects only (no `lookup`
+ * re-resolution between hops). Exported for tests.
  */
 export declare function nodePinnedTransport(modules: NodeHttpModules): SsrfTransport;
 /**