Bump @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5

[dependabot]

Bumps @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5.

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v1.7.5

What's Changed

SDK

• Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @​victor-openai in #721

Specification

• Add missing HostCapabilities fields by @​hydrosquall in #653
• Sync object-src with default-src by @​domfarolino in #715

Examples

• lazy-auth-server: usable on mobile in #714
• map-server: fix README and code of conduct links in #657

Docs

• API Docs link for ext-apps/server in #697
• Add mcp-use inspector badge to supported clients by @​pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

• shell-quote 1.9.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv)
• @babel/core 7.29.7 (GHSA-4x5r-pxfx-6jf8)
• sharp ^0.35.3 (GHSA-f88m-g3jw-g9cj; libvips CVE-2026-33327 / 33328 / 35590 / 35591) — devDependency, screenshot tooling only
• brace-expansion 1.1.16 / 2.1.2, fast-uri 3.1.4, hono 4.12.31, linkify-it 5.0.2, markdown-it 14.3.0, body-parser 2.3.0, plus other transitives

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: modelcontextprotocol/ext-apps@v1.7.4...v1.7.5

Commits

• 92f46a5 chore: bump ext-apps to 1.7.5 (#724)
• 7d49807 chore: clear npm audit findings (15 -> 3) (#725)
• c55a3a2 fix: preserve experimental capability settings (#721)
• 2ca6a59 spec: sync object-src with default-src (#715)
• 9778cf9 Make lazy-auth-server usable on mobile (#714)
• cf87f2a ci: fix README prettier build failure (#698)
• cd969db docs: add mcp-use inspector badge to supported clients (#650)
• f0d9582 spec: add missing HostCapabilities fields (#653)
• ea8775d docs: API Docs link for ext-apps/server (#697)
• fa12744 docs: fix map-server readme and code of conduct links (#657)
• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[silverstein]

Thanks Dependabot. Leaving this one open, unlike the two sibling bumps.

This is a patch bump on the MCP Apps wrapper the viewer already depends on, so it is a plausible candidate rather than something to refuse. It does still need host lifecycle verification before merging, because this package governs how the viewer is created, surfaced, and torn down inside the host, and that behaviour is not exercised by the server-side test suite.

It will be picked up in the next host validation pass rather than merged on a green CI run alone.

[silverstein]

Superseded by #172, which lands this bump together with #48, #128, and #129 as one change.

All three of these touch package.json, package-lock.json, and the layout occurrence oracle, so landing them separately means three rebase-and-regenerate cycles where each merge invalidates the next one's lock and fixture. #172 regenerates each artifact once. It also carries the licence-evidence regeneration that a lock change requires and that none of these three included.

Closing this once #172 merges.

[dependabot]

A newer version of @​modelcontextprotocol/ext-apps exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.