chore(deps): update dependency mcp-searxng to v1.14.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp-searxng	1.12.1 → 1.14.0

---

Release Notes

ihor-sokoliuk/mcp-searxng (mcp-searxng)

v1.14.0

Compare Source

Added

• Configurable default search response format: Operators can set SEARXNG_DEFAULT_RESPONSE_FORMAT to the exact lowercase value text or json for calls that omit response_format. Explicit per-call values continue to take precedence, and unset, blank, or invalid configuration preserves the existing text default. The tool schema no longer advertises the hard-coded default: "text" annotation so clients can omit the argument and allow the operator default to apply; clients that explicitly send or auto-inject text continue to override it. The operator default also applies in lite-tools mode. (#​225)

• Bounded stateless Streamable HTTP mode: Set MCP_HTTP_STATELESS=true to isolate every POST /mcp in a fresh MCP server and transport for serverless or horizontally scaled deployments that cannot preserve process-local sessions. Stateless requests are protected by configurable global and per-client-IP in-flight limits, a request lifetime, authorization and hardened Host/Origin checks before server construction, and bounded cleanup. Stateful sessions remain the default; stateless mode is POST-only and does not preserve cross-request sessions, resumable streams, standalone GET notification streams, or DELETE-based termination. (#​226)

v1.13.0

Compare Source

Added

• FlareSolverr-primary failover to Byparr: Operators can configure FLARESOLVERR_URL, BYPARR_URL, or both. Dual mode always tries FlareSolverr first, advances to Byparr only for busy or transient-unavailable acquisition, and uses one uncached direct fetch only after every configured provider is busy or unavailable. Persistent 4xx, cancellation, solution-integrity failures, and solved non-2xx target status stop the chain. Provider timeouts and concurrency remain independent, cache entries use the winning provider, and canonically duplicate endpoints fail closed. Verified provider versions remain FlareSolverr 3.5.0 and Byparr 2.1.0 from 2026-07-30. (#​220, #​223, #​224)

  Migration note: Browser-solver endpoints are now validated during startup. A FLARESOLVERR_URL containing userinfo, a query, a fragment, or a non-HTTP(S) scheme now prevents startup instead of failing only when a URL read first uses it.

• Bounded PDF text extraction: web_url_read now extracts text-layer content from application/pdf responses using the new production unpdf dependency in a resource-limited worker. Input and output are capped at the lower of URL_READ_MAX_CONTENT_LENGTH_BYTES and 16 MiB, documents above 500 pages are rejected, parsing has a separate 30-second budget, and at most two extractions run concurrently. OCR is not supported. This supersedes the v1.10.0 behavior that rejected PDF responses. (#​221)

• Expanded operator and client guidance: New documentation covers self-hosted and public SearXNG instances, MCP client configuration, evidence-focused research workflows, and measured deployment profiles. (#​214, #​215, #​216, #​217, #​218)

Fixed

• HTTP rate-limit settings now honor the strict integer-validation contract: MCP_RATE_WINDOW_MS, MCP_RATE_INIT_MAX, and MCP_RATE_SESSION_MAX reject fractional, unit-suffixed, exponent, non-decimal, non-positive, and unsafe values instead of accepting numeric prefixes. Invalid values fall back with a raw-value-free warning. Because previously accepted numeric prefixes may have produced a different effective limit, the documented default may be looser or stricter until the operator corrects the setting. (#​219)

• Solver and PDF documentation now matches runtime boundaries: Security and deployment guidance consistently describes browser-solver disclosure, acquisition fallback, PDF parsing limits, and timeout behavior. (#​222)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ mcp-searxng

• Status: Passed
• Tools scanned: 4
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅