fix(mcp): updated the package versions in hono/mcp (#1596)

* fix: updated the zod version

* fix: updated @modelcontextprotocol/sdk version

* chore: lock file

* chore: added changeset

* chore: minor changes

* chore: minor changes

* fix: added zod in deno.json

* chore: minor changes

* reverted changes in deno.json

* fix: added zod@4 in deno.json

* fix: added zod as peer dependency

* lockfile

* chore: minor change

* chore: minor changes

Author: MathurAditya724

.changeset/evil-keys-jog.md

@@ -0,0 +1,5 @@
+---
+'@hono/mcp': patch
+---
+
+updated zod and @modelcontextprotocol/sdk versions

packages/mcp/package.json

@@ -52,19 +52,20 @@
     "pkce-challenge": "^5.0.0"
   },
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": "^1.17.3",
+    "@modelcontextprotocol/sdk": "^1.23.0",
     "hono": "*",
-    "hono-rate-limiter": "^0.4.2"
+    "hono-rate-limiter": "^0.4.2",
+    "zod": "^3.25.0 || ^4.0.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.17.4",
-    "@modelcontextprotocol/sdk": "^1.19.1",
+    "@modelcontextprotocol/sdk": "^1.23.0",
     "@types/node": "^24.2.1",
     "hono": "^4.10.6",
     "hono-rate-limiter": "^0.4.2",
     "tsdown": "^0.15.9",
     "typescript": "^5.8.2",
     "vitest": "^3.2.4",
-    "zod": "^3.25.34"
+    "zod": "^4.0.0"
   }
 }

packages/mcp/src/auth/helpers/authorize.ts

@@ -7,7 +7,7 @@ import {
 } from '@modelcontextprotocol/sdk/server/auth/errors.js'
 import type { OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js'
 import type { MiddlewareHandler } from 'hono'
-import { z } from 'zod'
+import * as z from 'zod/v4'
 
 // Parameters that must be validated in order to issue redirects.
 const ClientAuthorizationParamsSchema = z.object({
@@ -27,7 +27,7 @@ const RequestAuthorizationParamsSchema = z.object({
   code_challenge_method: z.literal('S256'),
   scope: z.string().optional(),
   state: z.string().optional(),
-  resource: z.string().url().optional(),
+  resource: z.url().optional(),
 })
 
 export function authorizeHandler(provider: OAuthServerProvider): MiddlewareHandler {

packages/mcp/src/auth/helpers/token.ts

@@ -8,7 +8,7 @@ import {
 import type { OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js'
 import type { MiddlewareHandler } from 'hono'
 import { verifyChallenge } from 'pkce-challenge'
-import { z } from 'zod'
+import * as z from 'zod/v4'
 import type { ClientAuthenticationEnv } from '../middleware/client-auth'
 
 const TokenRequestSchema = z.object({
@@ -19,13 +19,13 @@ const AuthorizationCodeGrantSchema = z.object({
   code: z.string(),
   code_verifier: z.string(),
   redirect_uri: z.string().optional(),
-  resource: z.string().url().optional(),
+  resource: z.url().optional(),
 })
 
 const RefreshTokenGrantSchema = z.object({
   refresh_token: z.string(),
   scope: z.string().optional(),
-  resource: z.string().url().optional(),
+  resource: z.url().optional(),
 })
 
 export function tokenHandler(

packages/mcp/src/auth/middleware/client-auth.ts

@@ -7,7 +7,7 @@ import {
 } from '@modelcontextprotocol/sdk/server/auth/errors.js'
 import type { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js'
 import type { MiddlewareHandler } from 'hono'
-import { z } from 'zod'
+import * as z from 'zod/v4'
 
 export type ClientAuthenticationMiddlewareOptions = {
   /**

packages/mcp/src/streamable-http.test.ts

@@ -9,7 +9,7 @@ import type { CallToolResult, JSONRPCMessage } from '@modelcontextprotocol/sdk/t
 import type { Context } from 'hono'
 import { Hono } from 'hono'
 import { HTTPException } from 'hono/http-exception'
-import { z } from 'zod'
+import * as z from 'zod/v4'
 import { StreamableHTTPTransport } from './streamable-http'
 
 /**

yarn.lock

@@ -2109,19 +2109,20 @@ __metadata:
   resolution: "@hono/mcp@workspace:packages/mcp"
   dependencies:
     "@arethetypeswrong/cli": "npm:^0.17.4"
-    "@modelcontextprotocol/sdk": "npm:^1.19.1"
+    "@modelcontextprotocol/sdk": "npm:^1.23.0"
     "@types/node": "npm:^24.2.1"
     hono: "npm:^4.10.6"
     hono-rate-limiter: "npm:^0.4.2"
     pkce-challenge: "npm:^5.0.0"
     tsdown: "npm:^0.15.9"
     typescript: "npm:^5.8.2"
     vitest: "npm:^3.2.4"
-    zod: "npm:^3.25.34"
+    zod: "npm:^4.0.0"
   peerDependencies:
-    "@modelcontextprotocol/sdk": ^1.17.3
+    "@modelcontextprotocol/sdk": ^1.23.0
     hono: "*"
     hono-rate-limiter: ^0.4.2
+    zod: ^3.25.0 || ^4.0.0
   languageName: unknown
   linkType: soft
 
@@ -3467,9 +3468,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@modelcontextprotocol/sdk@npm:^1.19.1":
-  version: 1.22.0
-  resolution: "@modelcontextprotocol/sdk@npm:1.22.0"
+"@modelcontextprotocol/sdk@npm:^1.23.0":
+  version: 1.23.0
+  resolution: "@modelcontextprotocol/sdk@npm:1.23.0"
   dependencies:
     ajv: "npm:^8.17.1"
     ajv-formats: "npm:^3.0.1"
@@ -3482,14 +3483,17 @@ __metadata:
     express-rate-limit: "npm:^7.5.0"
     pkce-challenge: "npm:^5.0.0"
     raw-body: "npm:^3.0.0"
-    zod: "npm:^3.23.8"
-    zod-to-json-schema: "npm:^3.24.1"
+    zod: "npm:^3.25 || ^4.0"
+    zod-to-json-schema: "npm:^3.25.0"
   peerDependencies:
     "@cfworker/json-schema": ^4.1.1
+    zod: ^3.25 || ^4.0
   peerDependenciesMeta:
     "@cfworker/json-schema":
       optional: true
-  checksum: 10c0/71f4bef238715c248aa197ce820f95ac4fc75c7c311fc7d88c2e01d12692bffc5c9b9e3fe4c266ae0cca5df08c5b2fb6d60ab05d8905399665b67417d297903e
+    zod:
+      optional: false
+  checksum: 10c0/b0291f921ad9bda06bbf1a61b1bb61ceca1173da5d74d39a411c40428d6ca50a95f0de3a1631f25a44b439220b15c30c1306600bf48bef665ab7ad118d528260
   languageName: node
   linkType: hard
 
@@ -17293,6 +17297,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"zod-to-json-schema@npm:^3.25.0":
+  version: 3.25.0
+  resolution: "zod-to-json-schema@npm:3.25.0"
+  peerDependencies:
+    zod: ^3.25 || ^4
+  checksum: 10c0/2d2cf6ca49752bf3dc5fb37bc8f275eddbbc4020e7958d9c198ea88cd197a5f527459118188a0081b889da6a6474d64c4134cd60951fa70178c125138761c680
+  languageName: node
+  linkType: hard
+
 "zod@npm:3.22.3":
   version: 3.22.3
   resolution: "zod@npm:3.22.3"
@@ -17335,10 +17348,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod@npm:^3.25.34":
-  version: 3.25.34
-  resolution: "zod@npm:3.25.34"
-  checksum: 10c0/29f836f6dacace3ae247318362019937f429146676f6d185dbf62f808bba3783dff11f60d49864c4d9589b3d85c353a9fbd36c2fbe8c91b06447ab600243a6c5
+"zod@npm:^3.25 || ^4.0, zod@npm:^4.0.0":
+  version: 4.1.13
+  resolution: "zod@npm:4.1.13"
+  checksum: 10c0/d7e74e82dba81a91ffc3239cd85bc034abe193a28f7087a94ab258a3e48e9a7ca4141920cac979a0d781495b48fc547777394149f26be04c3dc642f58bbc3941
   languageName: node
   linkType: hard