chore: bump deps (#14065)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated dependency versions across the monorepo (notably zod →
^3.25.76 and vitest-related packages → ^3.2.4), plus minor package bumps
to align tooling and libraries. These are manifest/test-tooling updates
only; no public API, behavior, or end-user features were changed.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/package.json

@@ -40,7 +40,7 @@
     "@fal-ai/serverless-client": "^0.15.0",
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^2.4.1",
     "@google-cloud/opentelemetry-resource-util": "^2.4.0",
-    "@modelcontextprotocol/sdk": "^1.16.0",
+    "@modelcontextprotocol/sdk": "^1.24.3",
     "@nestjs-cls/transactional": "^2.6.1",
     "@nestjs-cls/transactional-adapter-prisma": "^1.2.19",
     "@nestjs/apollo": "^13.0.4",
@@ -49,7 +49,7 @@
     "@nestjs/core": "^11.0.12",
     "@nestjs/graphql": "^13.0.4",
     "@nestjs/platform-express": "^11.0.12",
-    "@nestjs/platform-socket.io": "^11.0.12",
+    "@nestjs/platform-socket.io": "^11.1.9",
     "@nestjs/schedule": "^6.0.0",
     "@nestjs/throttler": "^6.4.0",
     "@nestjs/websockets": "^11.0.12",
@@ -96,7 +96,7 @@
     "ioredis": "^5.4.1",
     "is-mobile": "^5.0.0",
     "jose": "^6.1.3",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
     "keyv": "^5.2.2",
     "lodash-es": "^4.17.21",
     "mixpanel": "^0.18.0",
@@ -122,7 +122,7 @@
     "typescript": "^5.7.2",
     "winston": "^3.17.0",
     "yjs": "^13.6.21",
-    "zod": "^3.24.1"
+    "zod": "^3.25.76"
   },
   "devDependencies": {
     "@affine-tools/cli": "workspace:*",

packages/backend/server/src/plugins/copilot/mcp/provider.ts

@@ -2,7 +2,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import { Injectable } from '@nestjs/common';
 import { pick } from 'lodash-es';
-import z from 'zod';
+import z from 'zod/v3';
 
 import { DocReader } from '../../../core/doc';
 import { AccessController } from '../../../core/permission';
@@ -32,9 +32,9 @@ export class WorkspaceMcpProvider {
       {
         title: 'Read Document',
         description: 'Read a document with given ID',
-        inputSchema: {
+        inputSchema: z.object({
           docId: z.string(),
-        },
+        }),
       },
       async ({ docId }) => {
         const notFoundError: CallToolResult = {
@@ -74,7 +74,7 @@ export class WorkspaceMcpProvider {
               text: content.markdown,
             },
           ],
-        };
+        } as const;
       }
     );
 
@@ -84,9 +84,9 @@ export class WorkspaceMcpProvider {
         title: 'Semantic Search',
         description:
           'Retrieve conceptually related passages by performing vector-based semantic similarity search across embedded documents; use this tool only when exact keyword search fails or the user explicitly needs meaning-level matches (e.g., paraphrases, synonyms, broader concepts, recent documents).',
-        inputSchema: {
+        inputSchema: z.object({
           query: z.string(),
-        },
+        }),
       },
       async ({ query }, req) => {
         query = query.trim();
@@ -122,7 +122,7 @@ export class WorkspaceMcpProvider {
             type: 'text',
             text: clearEmbeddingChunk(doc).content,
           })),
-        };
+        } as const;
       }
     );
 
@@ -132,9 +132,9 @@ export class WorkspaceMcpProvider {
         title: 'Keyword Search',
         description:
           'Fuzzy search all workspace documents for the exact keyword or phrase supplied and return passages ranked by textual match. Use this tool by default whenever a straightforward term-based or keyword-base lookup is sufficient.',
-        inputSchema: {
+        inputSchema: z.object({
           query: z.string(),
-        },
+        }),
       },
       async ({ query }) => {
         query = query.trim();
@@ -161,7 +161,7 @@ export class WorkspaceMcpProvider {
             type: 'text',
             text: JSON.stringify(pick(doc, 'docId', 'title', 'createdAt')),
           })),
-        };
+        } as const;
       }
     );