[dependabot]

Removes @modelcontextprotocol/server. It's no longer used after updating ancestor dependency @mastra/client-js. These dependencies need to be updated together.

Removes @modelcontextprotocol/server

Updates @mastra/client-js from 1.42.4 to 1.58.0

Release notes

Sourced from @​mastra/client-js's releases.

August 12, 2026

Highlights

File-based Agent Schedules

File-based agents can now declare recurring tasks via a schedules/ directory (TS or Markdown) that syncs to schedule storage at startup, eliminating runtime registration code and making schedule IDs stable across builds.

New Storage Provider: @mastra/oracledb

Added @mastra/oracledb with OracleStore (composite storage across Mastra domains) and OracleVector (Oracle 23ai+ VECTOR columns with metadata filtering), enabling Oracle Database-backed deployments.

QuickJS In-Process Code Mode Transport (@mastra/quickjs)

New @mastra/quickjs transport runs model-authored programs in an in-process QuickJS WASM runtime (no native addon, no --no-node-snapshot), enabling Code Mode on more serverless hosts without a full sandbox.

Dynamic Workflows: Workflow Builder API + Code SDK Management

Dynamic workflows gain a reusable Workflow Builder authoring API (createWorkflowBuilderAgent) plus Mastra Code SDK support for discovery-backed creation, persistence, execution, and deletion of workflows.

Custom createRoute() API Routes Across Server + Adapters

createRoute() routes can now be registered via server.apiRoutes with native validation/auth/streaming/OpenAPI support on @mastra/server, and are supported in server adapters (Hono/Express/Fastify/Koa) for consistent typed routing.

Breaking Changes

• Stored workflows renamed to dynamic workflows: addStoredWorkflow(s) → addDynamicWorkflow(s), StoredWorkflow* types → DynamicWorkflow*, and workflow.origin now reports 'dynamic'.
• Channel agent replies now post as markdown by default; set textFormat: 'plain' on channel adapter configs (e.g. Slack) to preserve literal plain-text posting.

Changelog

@​mastra/core@1.58.0

Minor Changes

• Add resolveSession and onStaleToolApproval to agent controller channels. (#21094)

  resolveSession creates the session for a mapped channel thread in place of the built-in call. It runs before any session exists, so a host can refuse a request before a session, a model call, or any output happens, which is something onSessionStart cannot do, because it runs after the session is created and swallows errors. A refusal is silent: the chat thread gets nothing, so the host's authorization message never lands in a shared channel. Other failures still post an error to the thread as before, and a refusal is distinguishable as ChannelSessionRejectedError with the original error as its cause.

  Approval actions now resolve their session with the action's own request context, so a shared install can revalidate the person answering an approval instead of trusting the request that opened the session.

  onStaleToolApproval reports approval actions that have no matching parked gate, which is every approval answered after a restart. Mastra still refuses to run the tool; the hook lets a durable host settle that attempt rather than dropping the answer. It receives the runId the approval card was rendered for: the attempt the user answered, plus the session's currentRunId, which after a restart is usually null or a different run.

• Added typed experiment provenance and grouping fields that persist across synchronous and asynchronous runs and can be filtered when listing experiments. (#20645)

  await dataset.startExperiment({
    task,
    scorers,
    provenance: { source: 'github', sourceVersion: 'abc123' },
    grouping: { experimentSetId: 'benchmark-1', variantId: 'candidate', trialIndex: 0 },
  });

• Added instructions.ts as a code alternative to instructions.md for file-based agents. Use it when the prompt needs TypeScript, for example when it's built from shared constants or resolved per request. (#20847)

  Before, a computed prompt had to move into config.ts, splitting it away from the agent's other instructions:

... (truncated)

Commits

• 77076a1 chore: version - exit prerelease mode
• 582ef17 chore: version packages (alpha) (#28888)
• 0fa401d docs(observability): align trace and span query references (#29041)
• 5cc1e6a fix(server): report resolver-backed workspace capabilities in workspace route...
• b89557e Group span aggregates by model and provider (#28908)
• 80f2f21 feat: show MCP tasks in Studio (server Tasks panel and tool-call task chip) (...
• 690bd1b feat(observability): query spans and traces by outcome and stop reason (#28884)
• c0918c0 feat(core): add dashboard definition schema and storage envelope check (#28714)
• 69c79cf Support model and provider filters in span queries (#28859)
• 4c56da4 feat(observability): saved view state schema and URL conversions for list pag...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.