[dependabot]

Removes @modelcontextprotocol/server. It's no longer used after updating ancestor dependency @mastra/client-js. These dependencies need to be updated together.

Removes @modelcontextprotocol/server

Updates @mastra/client-js from 1.42.4 to 1.55.0

Release notes

Sourced from @​mastra/client-js's releases.

July 30, 2026

Highlights

In-process Code Mode execution (no workspace sandbox required)

Code Mode transports can now declare requiresSandbox: false, letting createCodeMode() run without a workspace sandbox for in-process execution boundaries. This enables secure in-process runtimes like V8 isolates and exports sanitizeToolId so transports can share consistent external_* naming.

New @mastra/isolated-vm package for V8-isolated Code Mode

Introduces @mastra/isolated-vm with IsolatedVmCodeModeTransport, running model-authored programs inside an in-process V8 isolate with no filesystem/network/process access (only bridged external_* tools). Note: requires isolated-vm native addon and Node 20+ hosts must start with --no-node-snapshot.

Built-in provider-native Web Search tool

@mastra/core adds webSearchTool, a first-party web search tool that resolves to provider-native search when supported by the configured model/provider, simplifying “current info” agent setups.

Stored agent drafts via autoPublish (Server + JS SDK)

Both @mastra/server and @mastra/client-js add autoPublish to stored agent creation so you can create an initial unpublished draft for review before publishing (existing calls still publish immediately by default).

New Factory channel identity domain + channels integration slot

@mastra/factory adds a channel-identity storage domain to link chat-platform senders to Factory users, plus a channels() integration slot to attach an AgentControllerChannels during prepare() so inbound platform messages can drive the same agents as the web UI.

Breaking Changes

• ChannelHandler context parameter is now required: the 4th parameter is ctx: ChannelHandlerContext (non-optional). Code that calls a ChannelHandler-typed function with only three args must be updated to pass ctx.

Changelog

@​mastra/core@1.55.0

Minor Changes

• Added support for Code Mode transports that provide their own execution boundary. A transport can now declare requiresSandbox: false and createCodeMode() will run it without a workspace sandbox, which enables in-process transports such as IsolatedVmCodeModeTransport from @mastra/isolated-vm: (#20359)

  import { createCodeMode } from '@mastra/core/tools';
  import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
  // No sandbox needed — the V8 isolate is the execution boundary
  const { tool, instructions } = createCodeMode({ tools }, new IsolatedVmCodeModeTransport());

  Also fixed the generated Code Mode instructions to describe isolation accurately instead of always claiming the program runs fully sandboxed, since the actual boundary depends on the configured sandbox and transport. The sanitizeToolId helper used for external_* naming is now exported from @mastra/core/tools so transports can reuse it instead of duplicating it.

• Added retry callbacks for stream error policies and ensured explicit matcher policies override provider retry metadata. (#19724)

• Channel handlers can now contribute to the request context of the run they start. (#20060)

  ChannelHandlerContext gains a requestContext field holding the RequestContext for the run the inbound message is about to start. It is constructed fresh for every message, and a handler may write to it before calling defaultHandler. Core then adds its own channel and render-context entries and dispatches with the same instance, so anything the handler wrote reaches the run.

  import { AgentControllerChannels } from '@mastra/core/channels';
  const channels = new AgentControllerChannels({
  adapters,
  handlers: {

... (truncated)

Commits

• fe51609 chore: version - exit prerelease mode
• 15f45e4 chore: version packages (alpha) (#27188)
• a9b85ba feat(observability): advertise trace aggregation to clients (#27185)
• e2be59a chore: version packages (alpha) (#27184)
• 4c981d8 feat(observability): report trace retention and let the range picker block ol...
• 68942f4 chore: version packages
• 15f92b6 chore: version packages (alpha) (#27139)
• 032a92d feat: add queueSignal for queuing typed agent signals (#27081)
• 806d3cd chore: version packages
• fa25997 test: remove copy-paste duplicate tests and fix mislabeled ones (#27122)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

🟡 Changes recommended

The pnpm lockfile no longer matches the manifest’s overrides, blocking frozen installs.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• examples/agent-frameworks/mastra/package-lock.json: Generated file