fc09f6e5e7
Merge pull request #171 from tavily-ai/feat/eng-121-keyless-mode
...
feat: add keyless support
2026-05-29 10:21:18 -04:00
b9785d1891
feat: add keyless support
2026-05-28 14:33:51 -04:00
b66420629e
fix: bump axios, fast-uri, hono, ip-address (high+medium CVEs) ( #169 )
...
* fix: bump axios, fast-uri, hono, and ip-address to resolve vulnerabilities
Consolidates Dependabot PRs #163 , #164 , #165 , #166 :
- axios 1.15.0 -> 1.16.0 (DoS via incorrect data type — medium)
- fast-uri 3.1.0 -> 3.1.2 (ReDoS — high)
- hono 4.12.14 -> 4.12.18 (open redirect — medium)
- ip-address 10.1.0 -> 10.2.0 via express-rate-limit (medium)
* fix: bump qs to 6.15.2 to resolve CVE
Updates qs 6.14.2 → 6.15.2 (medium CVE — prototype pollution via __proto__)
2026-05-28 14:25:45 -04:00
7bcf90750e
Merge pull request #159 from tavily-ai/chore/add-human-id-support
...
Chore/add human id support
2026-04-24 14:35:14 -04:00
c916af44e1
update version
2026-04-24 14:31:44 -04:00
95ab6057e0
add human id support and a readme update
2026-04-24 11:32:34 -04:00
2911172e05
Merge pull request #155 from tavily-ai/fix/bump-security-deps
...
fix: bump follow-redirects + hono (medium CVEs)
2026-04-22 10:20:25 -05:00
5bb6164c80
fix: bump follow-redirects and hono to resolve vulnerabilities
...
- follow-redirects → 1.16.0 (leaks auth headers to cross-domain redirects)
- hono → 4.12.14 (HTML injection in hono/jsx SSR)
2026-04-22 09:50:50 -04:00
330e826947
auto-generate session_id per MCP process
2026-04-21 19:01:12 -04:00
ca98b3c086
Merge pull request #151 from tavily-ai/feat/tavily-mcp-cbf3dc
...
Add exact_match parameter to tavily_search tool
2026-04-15 13:24:26 -04:00
e8de380724
Add exact_match parameter to tavily_search tool
...
- Add exact_match to input schema with description
- Pass exact_match through in tool handler
- Include exact_match in search API request payload
2026-04-15 15:03:33 +00:00
925095d106
Merge pull request #146 from tavily-ai/dependabot/npm_and_yarn/hono/node-server-1.19.13
...
Bump @hono/node-server from 1.19.10 to 1.19.13
2026-04-13 11:38:43 -04:00
722b15f2ff
Merge pull request #147 from tavily-ai/dependabot/npm_and_yarn/hono-4.12.12
...
Bump hono from 4.12.7 to 4.12.12
2026-04-13 11:38:38 -04:00
7199d123b0
Merge pull request #150 from tavily-ai/dependabot/npm_and_yarn/axios-1.15.0
...
Bump axios from 1.13.5 to 1.15.0
2026-04-13 11:38:34 -04:00
1fc43ea686
Bump axios from 1.13.5 to 1.15.0
...
Bumps [axios](https://github.com/axios/axios ) from 1.13.5 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.15.0 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.15.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-12 10:41:30 +00:00
2e10925606
Bump hono from 4.12.7 to 4.12.12
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.7 to 4.12.12.
- [Release notes](https://github.com/honojs/hono/releases )
- [Commits](https://github.com/honojs/hono/compare/v4.12.7...v4.12.12 )
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.12
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-08 04:12:02 +00:00
1835d88d46
Bump @hono/node-server from 1.19.10 to 1.19.13
...
Bumps [@hono/node-server](https://github.com/honojs/node-server ) from 1.19.10 to 1.19.13.
- [Release notes](https://github.com/honojs/node-server/releases )
- [Commits](https://github.com/honojs/node-server/compare/v1.19.10...v1.19.13 )
---
updated-dependencies:
- dependency-name: "@hono/node-server"
dependency-version: 1.19.13
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-08 03:14:11 +00:00
926ff5da7b
Merge pull request #138 from tavily-ai/dependabot/npm_and_yarn/path-to-regexp-8.4.0
...
Bump path-to-regexp from 8.3.0 to 8.4.0
2026-03-30 14:18:16 -04:00
cc0b66ef0e
Bump path-to-regexp from 8.3.0 to 8.4.0
...
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp ) from 8.3.0 to 8.4.0.
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases )
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md )
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v8.3.0...v8.4.0 )
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-28 18:59:22 +00:00
238f6fdb28
Merge pull request #122 from tavily-ai/dependabot/npm_and_yarn/hono-4.12.7
...
Bump hono from 4.12.5 to 4.12.7
2026-03-13 15:29:50 -04:00
912a02bac8
Merge pull request #126 from tavily-ai/feat/update-error-msgs
...
bump version
2026-03-12 14:47:20 -04:00
f618a917f0
bump version
2026-03-12 14:44:36 -04:00
ba53750aa5
Bump hono from 4.12.5 to 4.12.7
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.5 to 4.12.7.
- [Release notes](https://github.com/honojs/hono/releases )
- [Commits](https://github.com/honojs/hono/compare/v4.12.5...v4.12.7 )
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-11 02:11:49 +00:00
ed98b5061f
Merge pull request #120 from tavily-ai/dependabot/npm_and_yarn/express-rate-limit-8.3.0
...
Bump express-rate-limit from 8.2.1 to 8.3.0
2026-03-06 14:53:30 -05:00
311bc28cf9
Bump express-rate-limit from 8.2.1 to 8.3.0
...
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit ) from 8.2.1 to 8.3.0.
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases )
- [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.2.1...v8.3.0 )
---
updated-dependencies:
- dependency-name: express-rate-limit
dependency-version: 8.3.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-06 19:42:13 +00:00
8787509b6a
Merge pull request #115 from tavily-ai/dependabot/npm_and_yarn/hono-4.12.5
...
Bump hono from 4.12.2 to 4.12.5
2026-03-04 17:19:23 -05:00
6aa3974394
Bump hono from 4.12.2 to 4.12.5
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.2 to 4.12.5.
- [Release notes](https://github.com/honojs/hono/releases )
- [Commits](https://github.com/honojs/hono/compare/v4.12.2...v4.12.5 )
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-04 22:18:58 +00:00
7368e83131
Merge pull request #116 from tavily-ai/dependabot/npm_and_yarn/hono/node-server-1.19.10
...
Bump @hono/node-server from 1.19.9 to 1.19.10
2026-03-04 17:17:47 -05:00
107ba04767
Bump @hono/node-server from 1.19.9 to 1.19.10
...
Bumps [@hono/node-server](https://github.com/honojs/node-server ) from 1.19.9 to 1.19.10.
- [Release notes](https://github.com/honojs/node-server/releases )
- [Commits](https://github.com/honojs/node-server/compare/v1.19.9...v1.19.10 )
---
updated-dependencies:
- dependency-name: "@hono/node-server"
dependency-version: 1.19.10
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-04 21:37:26 +00:00
e63fc273ed
Merge pull request #111 from tavily-ai/fix/bump-hono-lockfile
...
fix: bump hono to resolve timing comparison vulnerability
2026-02-23 16:49:02 -05:00
89981729f9
fix: bump hono to 4.12.2 to resolve timing comparison vulnerability
...
Resolves GHSA-gq3j-xvxp-8hrf (hono < 4.11.10 lacks timing-safe
comparison in basicAuth and bearerAuth middleware).
Lockfile-only change - hono is a transitive dependency via
@modelcontextprotocol/sdk.
2026-02-23 16:33:30 -05:00
5ad911737d
Merge pull request #108 from tavily-ai/dependabot/npm_and_yarn/ajv-8.18.0
...
Bump ajv from 8.17.1 to 8.18.0
2026-02-17 17:05:31 -05:00
79e4ca0938
Bump ajv from 8.17.1 to 8.18.0
...
Bumps [ajv](https://github.com/ajv-validator/ajv ) from 8.17.1 to 8.18.0.
- [Release notes](https://github.com/ajv-validator/ajv/releases )
- [Commits](https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0 )
---
updated-dependencies:
- dependency-name: ajv
dependency-version: 8.18.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-17 18:17:11 +00:00
f8e4466c0a
Merge pull request #106 from tavily-ai/dependabot/npm_and_yarn/qs-6.14.2
...
Bump qs from 6.14.1 to 6.14.2
2026-02-17 13:16:14 -05:00
8a8ea19364
Bump qs from 6.14.1 to 6.14.2
...
Bumps [qs](https://github.com/ljharb/qs ) from 6.14.1 to 6.14.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md )
- [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2 )
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-14 12:59:45 +00:00
d49f06afaf
Merge pull request #105 from tavily-ai/hotfix/bump-version
...
Bumping version
2026-02-11 15:01:19 -05:00
8c58d66dc5
Bumping version
2026-02-11 14:58:31 -05:00
8d56b65cbb
Merge pull request #104 from tavily-ai/chore/description-updates
...
update readme about user's ability to set key for the oauth flow in t…
2026-02-11 14:46:02 -05:00
fcf1aa08c2
set max results default to 5
2026-02-11 14:43:02 -05:00
f1aa15c351
update readme about user's ability to set key for the oauth flow in the remote mcp server, remove news from tool descriptions
2026-02-11 14:34:49 -05:00
2919428cae
Merge pull request #103 from tavily-ai/dependabot/npm_and_yarn/axios-1.13.5
...
Bump axios from 1.9.0 to 1.13.5
2026-02-11 12:13:16 -05:00
9b04471ea8
Bump axios from 1.9.0 to 1.13.5
...
Bumps [axios](https://github.com/axios/axios ) from 1.9.0 to 1.13.5.
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.9.0...v1.13.5 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.13.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-11 15:09:03 +00:00
90a060043f
Merge pull request #101 from tavily-ai/dependabot/npm_and_yarn/modelcontextprotocol/sdk-1.26.0
...
Bump @modelcontextprotocol/sdk from 1.25.2 to 1.26.0
2026-02-04 17:57:11 -05:00
cac9de71a9
Bump @modelcontextprotocol/sdk from 1.25.2 to 1.26.0
...
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk ) from 1.25.2 to 1.26.0.
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases )
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.2...v1.26.0 )
---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
dependency-version: 1.26.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-04 20:38:37 +00:00
bcb22478b4
Merge pull request #99 from tavily-ai/chore/fix-mcp-url-info
...
update the mcp url in auth flow readme
2026-01-29 09:55:08 -05:00
dff188ae04
update the mcp url in auth flow readme
2026-01-29 09:46:33 -05:00
d76b9bc206
Merge pull request #98 from tavily-ai/feat/research
...
feat(research): adding research tool to the tavily mcp
2026-01-28 15:17:33 -05:00
a2f133202f
Merge branch 'main' into feat/research
2026-01-28 14:24:16 -05:00
a99e46567a
feat(research): adding research tool to the tavily mcp
2026-01-28 14:22:31 -05:00
319a6ec834
Merge pull request #97 from tavily-ai/dependabot/npm_and_yarn/hono-4.11.7
...
Bump hono from 4.11.4 to 4.11.7
2026-01-28 13:44:31 -05:00
Yash Bhandare