chore(deps): update dependency mcp-searxng to v1.16.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp-searxng	1.14.1 → 1.16.0

---

Release Notes

ihor-sokoliuk/mcp-searxng (mcp-searxng)

v1.16.0

Compare Source

Added

• Bounded SearXNG response-body consumption: Search JSON and HTML fallback, /config, and suggestions now share a streaming response reader with a configurable SEARXNG_MAX_RESPONSE_BYTES ceiling (5 MiB by default). Request deadlines remain active until body consumption finishes, diagnostic previews are capped at 64 KiB, and oversized, partial, stalled, cancelled, or malformed bodies are rejected without parsing, caching, or health credit. Abort identity and credential redaction are preserved. (#​250)

  Migration note: Operators may set SEARXNG_MAX_RESPONSE_BYTES to a positive safe integer. Unset, blank, zero, negative, fractional, exponent, unit-suffixed, or unsafe values use the documented 5 MiB default with a value-free warning.

Security

• Origin validation now covers every Streamable HTTP request: Every present Origin is checked before MCP routing in compatibility, stateful, and stateless modes. Absent Origin remains supported for non-browser clients; safe loopback defaults and explicit MCP_HTTP_ALLOWED_ORIGINS replacement allowlists preserve intended browser access. (#​249)

Build / CI

• Node.js 24 LTS is tested and used for trusted publishing: Required CI now runs on Node.js 20 and 24, while npm and container publishing use Node.js 24. The package continues to support its documented Node.js 20 floor. (#​248)

v1.15.0

Compare Source

Added

• Configurable search result detail: searxng_web_search accepts optional result_detail values compact and full (default). Compact responses emit only safe title, URL, and description/content-snippet fields (JSON keys: title, url, content), while full responses retain the existing SearXNG metadata and research signals. SEARXNG_MAX_RESULT_CHARS applies only to result content in both modes.

  Migration note: compact text has exactly three lines per result and no preamble or cache annotation. Line parsers that rely on relevance scores or other metadata should request result_detail="full" or accept compact's three-line records.

  Compact suppresses warnings, provenance, and every other search signal. Full text adds valid optional metadata in fixed score, engines, category, published-date, thumbnail, and image-source order; invalid optional metadata is omitted, and text fields are normalized to single lines. Existing users with SEARXNG_MAX_RESULT_CHARS set now also receive truncated full JSON content.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ mcp-searxng

• Status: Passed
• Tools scanned: 4
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅