Skip to content

chore: update all dependencies - #4486

Merged
rahulguptajss merged 1 commit into
mainfrom
renovate/all
Sep 28, 2026
Merged

chore: update all dependencies#4486
rahulguptajss merged 1 commit into
mainfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
github.com/modelcontextprotocol/go-sdk v1.7.0 → v1.8.0 age confidence require minor
github/codeql-action v4.38.0 → v4.38.1 age confidence action patch v4.38.2
golang.org/x/net v0.58.0 → v0.59.0 age confidence indirect minor
step-security/setup-uv v10.0.0 → v10.0.1 age confidence action patch

Release Notes

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

v1.8.0

Compare Source

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction.
Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

  • plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #​1143.
  • blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #​1151.

Options below were removed, according to plan:

  • seterroroverwrite
  • enableoriginverification
  • disablecontenttypecheck
  • disablelocalhostprotection

Other Changes to the SDK

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.7.0...v1.8.0-pre.1

github/codeql-action (github/codeql-action)

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146
step-security/setup-uv (step-security/setup-uv)

v10.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: step-security/setup-uv@v10.0.0...v10.0.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 4am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@cla-bot cla-bot Bot added the cla-signed label Sep 28, 2026
@rahulguptajss
rahulguptajss merged commit 196abf9 into main Sep 28, 2026
14 checks passed
@rahulguptajss
rahulguptajss deleted the renovate/all branch September 28, 2026 07:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rahulguptajss rahulguptajss rahulguptajss approved these changes
@cgrinds cgrinds Awaiting requested review from cgrinds cgrinds is a code owner
@Hardikl Hardikl Awaiting requested review from Hardikl Hardikl is a code owner

Assignees

No one assigned

Labels

cla-signed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rahulguptajss