chore(deps): update dependency @modelcontextprotocol/ext-apps to v1.2.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/ext-apps	1.0.1 → 1.2.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

modelcontextprotocol/ext-apps (@​modelcontextprotocol/ext-apps)

v1.2.2: 1.2.2

Compare Source

What's Changed

• fix(schemas): import from zod/v4 to match SDK's zod API by @​ochafik in #​548
• chore: bump ext-apps to 1.2.2 by @​ochafik in #​549

Full Changelog: modelcontextprotocol/ext-apps@v1.2.1...v1.2.2

v1.2.1: 1.2.1

Compare Source

What's Changed

• test: exclude screenshot-gen from default E2E run; wire pdf-server tests by @​ochafik in #​537
• fix(build): copy schema.json to dist and externalize zod by @​ochafik in #​534
• ci: use npm ci with caching, validate typedoc links, align Node versions by @​ochafik in #​533
• fix: pre-commit stages only originally-staged files; add .npmrc by @​ochafik in #​538
• fix(deps): drop @​hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 by @​ochafik in #​535
• fix(ci): require maintainer association for /update-snapshots trigger by @​ochafik in #​532
• fix: skip debug log for high-frequency tool-input-partial notifications by @​antonpk1 in #​546
• fix: theme-aware README logo + docs preview CI by @​localden in #​545
• fix: bundle SDK+zod in react-with-deps (was byte-identical to ./react) by @​ochafik in #​539
• test(e2e): fix no-op security injection test via frames[] traversal by @​ochafik in #​540
• chore: bump ext-apps to 1.2.1 by @​ochafik in #​547

Full Changelog: modelcontextprotocol/ext-apps@v1.2.0...v1.2.1

v1.2.0: 1.2.0

Compare Source

Changes since 1.1.2:

Features

• feat: add readServerResource() and listServerResources() API to App (#​470, #​528)

Fixes

• fix: replace platform-specific optionalDependencies with bun devDependency (#​518)
• fix: autoResize reporting viewport height when content is taller (#​525)
• fix: remove duplicate --color-text-ghost from McpUiStyleVariableKey (#​523)
• fix: examples servers' npm run start:stdio (#​507)
• fix: work around tsx watch hang on Windows in quickstart (#​428)

Refactors

• refactor: remove unnecessary type assertions (#​471)
• refactor: replace deprecated RESOURCE_URI_META_KEY with modern format (#​457)

Examples & Plugin

• pdf-server: ignore client roots by default (#​510)
• plugin: refactor create-mcp-app skill to reference patterns.md (#​416)

Docs

• docs: add Security documentation section and SEO improvements (#​524)
• docs: add MCP client configuration examples to CONTRIBUTING.md (#​508, #​526)
• docs: use apps.extensions.modelcontextprotocol.io domain for docs URLs (#​499)
• docs: add SECURITY.md with GitHub Security Advisories guidance (#​472)

Full Changelog: modelcontextprotocol/ext-apps@v1.1.2...v1.2.0

v1.1.2: 1.1.2

Compare Source

What's Changed

• pdf-server: robust path validation + folder/file root support by @​ochafik in #​497
• feat: add ui/download-file method for host-mediated file downloads by @​antonpk1 in #​475
• ci: auto-fix prettier formatting in pre-commit hook and CI by @​ochafik in #​498
• fix: sync local SDK build into node_modules for examples by @​ochafik in #​504
• chore: bump ext-apps to 1.1.2 by @​ochafik in #​503

Full Changelog: modelcontextprotocol/ext-apps@v1.1.1...v1.1.2

v1.1.1: 1.1.1

Compare Source

What's Changed

• fix: add audio/video support for basic-host by @​Avcharov in #​460
• Adding ChatGPT to the readme by @​conorkel in #​486
• fix(pdf-server): remove page-loading overlay by @​ochafik in #​493
• pdf-server: remove domain allowlist, require HTTPS only by @​ochafik in #​487
• ci: add missing examples to deploy workflows by @​ochafik in #​494
• Add MCPB packaging and Claude Code plugin for pdf-server by @​bryan-anthropic in #​491
• ci: build and publish MCPB bundle for pdf-server by @​ochafik in #​495
• Set audioSession.type to playback in sheet music app by @​mel-anthropic in #​489
• chore: bump ext-apps to 1.1.1 by @​ochafik in #​496

Full Changelog: modelcontextprotocol/ext-apps@v1.1.0...v1.1.1

v1.1.0: 1.1.0

Compare Source

What's Changed

• Fix: registerAppResource does not return registered resource, but void by @​KKonstantinov in #​370
• Use escaped newlines in ShaderToy README JSON examples by @​jonathanhefner in #​375
• Fix extractRegion() matching region names that are substrings of others by @​jonathanhefner in #​376
• Improve patterns guide with concrete examples and safe area insets by @​jonathanhefner in #​381
• feat(pdf-server): send screenshot to updateModelContext by @​ochafik in #​373
• Separate static and dynamic data in system-monitor-server tools by @​jonathanhefner in #​388
• docs: add root npm install step for basic-host setup by @​GiladShoham in #​371
• Add polling pattern to patterns guide by @​jonathanhefner in #​389
• Add binary blob resource pattern to patterns guide by @​jonathanhefner in #​391
• Add server-side persistence guidance to view state pattern by @​jonathanhefner in #​397
• examples: add MCP Apps arcade server by @​idosal in #​346
• examples: add arcade example to servers by @​idosal in #​399
• docs: fix basic-host setup instructions in quickstart by @​rafa-thayto in #​398
• Improve global.css as scaffolding template by @​jonathanhefner in #​403
• Improve documentation for CSP and permissions types by @​jonathanhefner in #​409
• Improve example CSS files to better demonstrate host style integration by @​jonathanhefner in #​404
• Extract getUiCapability example to type-checked examples file by @​jonathanhefner in #​406
• examples: remove arcade by @​idosal in #​414
• Cache full PDF bodies from servers without Range support by @​ochafik in #​411
• Add CSP and CORS section to patterns docs by @​jonathanhefner in #​415
• Add isToolVisibilityModelOnly and isToolVisibilityAppOnly helper functions by @​matteo8p in #​294
• Use escaped double quotes in npm scripts for Windows compatibility by @​jonathanhefner in #​421
• Replace "external" with "network" in CSP documentation by @​jonathanhefner in #​422
• Clarify spec and SDK: accept UIResourceMeta in both resources/list and resources/read by @​ochafik in #​410
• Rename skill to 'create-mcp-app' to align with spec by @​vgshenoy in #​443
• Rename migrate-oai-app skill name to align with spec by @​jonathanhefner in #​444
• Handle non-JSON-RPC messages gracefully in PostMessageTransport by @​ochafik in #​448
• Update theme toggle button position in CSS from top to bottom by @​healthkowshik in #​441
• fix: align basic-host dark mode styles by @​Avcharov in #​438
• Change Host <> Sandbox communication protocol to "SHOULD" by @​mstoiber-oai in #​435
• Upgrade GitHub Actions to latest versions by @​salmanmkc in #​393
• Upgrade GitHub Actions for Node 24 compatibility by @​salmanmkc in #​392
• Apply typedoc-github-theme typography fixes locally via customCss by @​jonathanhefner in #​442
• Add validation for callServerTool params argument by @​ochafik in #​449
• fix: update e2e test snapshots for shadertoy and wiki-explorer images by @​Avcharov in #​461
• README update by @​localden in #​463
• Upgrade typedoc-github-theme to v0.4.0 and remove local CSS workaround by @​jonathanhefner in #​462
• Add double-connect guard to prevent protocol message handling errors by @​ochafik in #​450
• Add PDF search feature to pdf-server by @​ochafik in #​445
• Add fullscreen button to threejs-server by @​ochafik in #​446
• feat(pdf-server): use MCP roots to auto-allow local directories by @​ochafik in #​479
• Lead README with agent skills for faster onboarding by @​localden in #​478
• Update README.md by @​localden in #​483
• pdf: ignore safe area insets in fullscreen mode by @​ochafik in #​484
• feat(pdf-server): lazy range-based loading + eager background preloading by @​ochafik in #​480
• chore: bump ext-apps to 1.1.0 by @​ochafik in #​485

Full Changelog: modelcontextprotocol/ext-apps@v1.0.1...v1.1.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[JAORMX]

CI is green. LGTM.