[mikecao]

Fixes all 6 open Dependabot alerts on master.

Changes

• @modelcontextprotocol/server 2.0.0 → 2.3.1 (packages/mcp). This closes alerts IE tracker fix #365, Next basePath duplicated with <Link /> elements #366 and Optimize Multi-Device Favicon #367 (2 high, 1 medium; affected range >=2.0.0 <2.3.0). The @modelcontextprotocol/client dev dependency range is raised to ^2.3.1 as well so client and server stay on the same version.
• vite security floor raised from 8.0.16 to 8.1.6 in pnpm-workspace.yaml overrides. This closes alerts What happens if I forget the SALT? #368, Event type/value are too constrained #369 and How to integrate with plain HTML/CSS website? #370 (1 high, 2 medium; affected range >=8.0.0 <=8.1.5). The old floor of 8.0.16 was itself inside the vulnerable range. vite now resolves to 8.1.6, which brings rolldown 1.0.3 → 1.1.5 along with it.

This branch is based on master and contains only these changes.

Verification

• pnpm test passes (118 files, 882 tests)
• pnpm --filter @umami/mcp typecheck passes
• pnpm --filter @umami/mcp test passes (27 tests)
• pnpm --filter @umami/mcp build succeeds

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
umami	Ready	Preview	Oct 22, 2026 10:56pm UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
umami-analytics-eu	Ignored		Oct 22, 2026 10:56pm UTC
umami-analytics-us	Ignored		Oct 22, 2026 10:56pm UTC
umami-postgresql	Ignored		Oct 22, 2026 10:56pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates MCP dependencies and raises the Vite minimum version.

• Umami’s MCP package uses version 2.3.1 of its server tools.
• Workspace dependencies now use Vite 8.1.6 as their minimum version.

_{Reviews (1) · Last reviewed commit: "Bump @modelcontextprotocol/server to 2.3..." · Reviewed by Greptile}