chore: update all mcp-worker dependencies to latest versions

[jonathannorris]

Summary

• Updates all mcp-worker dependencies to their latest versions
• Migrates to ably 2.x (Rest.Promise removed, webworker-specific import path dropped)
• Removes @ts-expect-error workaround for Hono/OAuthProvider type mismatch (fixed upstream in workers-oauth-provider 0.2.4+)
• Adds scoped agents/@modelcontextprotocol/sdk resolution to deduplicate the MCP SDK (agents pins 1.26.0, root uses 1.27.1)
• Stubs out the ai module via wrangler [alias] — agents 0.7.6 bundles unused features that dynamically import("ai"), which breaks wrangler's esbuild bundler
• Regenerates worker-configuration.d.ts with wrangler 4.72.0, moves secret type declarations (AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, ABLY_API_KEY) to a separate env.d.ts so wrangler types can be re-run without losing them

Dependency changes

Package	Before	After	Notes
@cloudflare/workers-oauth-provider	^0.0.13	^0.3.0	revokeExistingGrants default, improved TS types
ably	^1.2.48	^2.19.0	Major: Rest.Promise -> Rest, webworker import removed
agents	^0.2.19	^0.7.6	Addresses Dependabot XSS alerts #121-#123
jose	^6.1.0	^6.2.1	Minor
oauth4webapi	^3.8.1	^3.8.5	Patch
@types/node	^24.5.2	^25.4.0	Major typings
wrangler	^4.38.0	^4.72.0	Minor

hono and vitest were already at latest.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	5bba4be	Mar 12 2026, 07:59 PM

[Copilot]

Pull request overview

Updates the mcp-worker workspace to newer dependency versions and applies the necessary code changes to keep the worker building/running with the upgraded packages (notably Ably 2.x and workers-oauth-provider 0.3.x). It also adds a scoped Yarn resolution intended to deduplicate the MCP SDK version across the root package and the agents dependency chain.

Changes:

• Bumped mcp-worker runtime/dev dependencies (e.g. @cloudflare/workers-oauth-provider, ably, agents, wrangler, @types/node) and updated yarn.lock accordingly.
• Migrated Ably usage from Rest.Promise + webworker-specific import to new Rest() + top-level ably import, and updated unit tests/mocks.
• Added a scoped Yarn resolutions override for agents/@modelcontextprotocol/sdk to prefer 1.27.1.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
yarn.lock	Lockfile updates reflecting dependency upgrades and new transitive dependency graph.
package.json	Adds scoped resolutions override for agents/@modelcontextprotocol/sdk.
mcp-worker/package.json	Updates mcp-worker dependency versions (runtime + dev).
mcp-worker/src/index.ts	Removes no-longer-needed TS suppression around OAuth provider wiring.
mcp-worker/src/ably.ts	Updates Ably import and Rest client instantiation for Ably 2.x.
mcp-worker/src/ably.test.ts	Updates Ably module mock/test expectations to match Ably 2.x Rest usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 11 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[suthar26]

should sanity test the mcp before merging, if not dont yet. code changes make sense as per the migration guide by ably

[jonathannorris]

yea @suthar26 ran the MCP worker locally, but will need to test it once its released.