Bump the production-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: @modelcontextprotocol/ext-apps and tar.

Updates @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v1.7.5

What's Changed

SDK

• Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @​victor-openai in #721

Specification

• Add missing HostCapabilities fields by @​hydrosquall in #653
• Sync object-src with default-src by @​domfarolino in #715

Examples

• lazy-auth-server: usable on mobile in #714
• map-server: fix README and code of conduct links in #657

Docs

• API Docs link for ext-apps/server in #697
• Add mcp-use inspector badge to supported clients by @​pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

• shell-quote 1.9.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv)
• @babel/core 7.29.7 (GHSA-4x5r-pxfx-6jf8)
• sharp ^0.35.3 (GHSA-f88m-g3jw-g9cj; libvips CVE-2026-33327 / 33328 / 35590 / 35591) — devDependency, screenshot tooling only
• brace-expansion 1.1.16 / 2.1.2, fast-uri 3.1.4, hono 4.12.31, linkify-it 5.0.2, markdown-it 14.3.0, body-parser 2.3.0, plus other transitives

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: modelcontextprotocol/ext-apps@v1.7.4...v1.7.5

Commits

• 92f46a5 chore: bump ext-apps to 1.7.5 (#724)
• 7d49807 chore: clear npm audit findings (15 -> 3) (#725)
• c55a3a2 fix: preserve experimental capability settings (#721)
• 2ca6a59 spec: sync object-src with default-src (#715)
• 9778cf9 Make lazy-auth-server usable on mobile (#714)
• cf87f2a ci: fix README prettier build failure (#698)
• cd969db docs: add mcp-use inspector badge to supported clients (#650)
• f0d9582 spec: add missing HostCapabilities fields (#653)
• ea8775d docs: API Docs link for ext-apps/server (#697)
• fa12744 docs: fix map-server readme and code of conduct links (#657)
• See full diff in compare view

Updates tar from 7.5.19 to 7.5.22

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.