[cixzhang]

Supersedes #7764 (co-authored by dependabot).

Maintainer impact

• Before: the docsite's MCP route runs on @modelcontextprotocol/sdk 1.30.0.
• After: it runs on 1.32.2, the newest release older than the workspace's 7-day minimumReleaseAge. The docsite's range becomes ^1.32.0, as dependabot proposed.
• No young transitive dependencies: the lockfile moves only the SDK. chore(deps): bump @modelcontextprotocol/sdk from 1.30.0 to 1.32.0 #7764's lockfile pulled in fast-uri, jose and qs releases that were still inside the release-age window. A fresh pnpm 11.10.0 resolution doesn't, and the supply-chain policy check passes.

Change

• apps/docsite/package.json: @modelcontextprotocol/sdk ^1.30.0 → ^1.32.0.
• pnpm-lock.yaml: regenerated with pnpm 11.10.0. Only @modelcontextprotocol/sdk (1.30.0 → 1.32.2, both of its peer variants) and mcp-handler's resolved peer move.

The docsite is private, so there's no Changeset.

Evidence

• pnpm install --lockfile-only passes the supply-chain policy check.
• The docsite build, its MCP route tests and docsite-test run in this pull request's CI.
• CI impact: no job, runner or trigger changes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astryx	Ready	Preview	Nov 8, 2026 8:13pm UTC

[astracat-bot]

AI review status for this pull request.

Review status	Updated
🟢 Reviewed (for maintainers only)	Nov 8, 2026, 9:10 PM UTC

[github-actions]

PR Analysis Report

🔎 Preview · a8f7cf3

Storybook · Sandbox · built from this PR's head

Package size: no published package changed; no new dependencies.

API changes: none in this pull request

Committed API report behind this build: cli 29 rows, core 40 rows, theme-butter 1 row, theme-y2k 1 row; run pnpm api:report.

Not run on this PR: add ci:run-visual, ci:run-a11y or ci:run-rtl to run them.

---

_{Generated by PR Enrichment workflow | View full report}

[astracat-bot]

Approved pending CI: CI has not run on this head yet.

The SDK move is minimal: the lockfile changes only @modelcontextprotocol/sdk (both of its peer variants), the 1.32.2 integrity matches the npm registry, and its dependency list is unchanged from 1.30.0. A before/after run of the docsite's MCP route configuration returned identical handshake, tool-list and tool-call results; the only difference is that a tools/call sent without arguments now names the missing field in its error.

Next step: mark the pull request ready for review so its CI runs, including the docsite build and tests; the Vercel preview build of this head already succeeded.

[Automated review]