From 6da37bfa7d0282522c7785759f4d2f1544015354 Mon Sep 17 00:00:00 2001
From: Rajaul Uddin <110954532+uddin-rajaul@users.noreply.github.com>
Date: Sun, 21 Jun 2026 06:08:17 +0545
Subject: [PATCH] fix: bump @modelcontextprotocol/sdk to ^1.26.0
 (CVE-2026-25536) (#208)

Closes #199
---
 ponytail-mcp/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ponytail-mcp/package.json b/ponytail-mcp/package.json
index ec36878..96c1d82 100644
--- a/ponytail-mcp/package.json
+++ b/ponytail-mcp/package.json
@@ -7,7 +7,7 @@
   "license": "MIT",
   "scripts": { "test": "node --test ./test/*.test.js" },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.19.0",
+    "@modelcontextprotocol/sdk": "^1.26.0",
     "zod": "^3.23.0"
   }
 }