Bump undici and wrangler in /mcp-server

[dependabot]

Bumps undici to 7.28.0 and updates ancestor dependency wrangler. These dependencies need to be updated together.

Updates undici from 5.29.0 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

• f9eba0a Bumped v7.28.0 (#5430)
• a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
• 8cb10f9 websocket: limit the number of fragments in a message
• 04201f8 fix: honor requestTls when proxy is SOCKS5
• fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
• bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
• 9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
• 376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
• 3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
• 85a2405 fix(cache): trim qualified field names
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates wrangler from 3.114.17 to 4.114.0

Release notes

Sourced from wrangler's releases.

wrangler@4.114.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

  When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

  The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

• #14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

  Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

• #14593 02232f3 Thanks @​spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

  During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

• #14797 f8a8c2c Thanks @​roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

  Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

• Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

  • miniflare@4.20260722.0

wrangler@4.113.0

Minor Changes

... (truncated)

Commits

• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• 246ce92 [wrangler] Improve d1 create database-limit error message (#14373)
• 02232f3 [wrangler] compare origins, not hrefs, when classifying dev proxy fetch error...
• 8416b33 [wrangler] Fix grammar in container image-too-large error (#14788)
• f8a8c2c [wrangler] Explain missing Flagship app ID (#14797)
• 88f42e7 Version Packages (#14740)
• 9e61971 unskip agent memory remote bindings test (#14786)
• 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
• 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.