[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.24.3 → 1.32.2

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.2

Compare Source

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #​1766) by @​kishormorol in #​2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in #​2958
• chore: bump version to 1.32.2 by @​claude[bot] in #​3089

New Contributors

• @​kishormorol made their first contribution in #​2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

v1.32.1

Compare Source

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in #​2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in #​2942
• chore: bump version to 1.32.1 by @​claude[bot] in #​2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

v1.32.0

Compare Source

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in #​2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in #​2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in #​2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in #​2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in #​2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in #​2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in #​2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in #​2931
• chore: bump version to 1.32.0 by @​claude[bot] in #​2935

New Contributors

• @​raashish1601 made their first contribution in #​2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

v1.31.0

Compare Source

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in #​2888
• chore: bump version to 1.31.0 by @​claude[bot] in #​2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

v1.30.1

Compare Source

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in #​2717
• fix(auth): preserve resource URI without trailing slash (#​1968) by @​MukundaKatta in #​1972
• chore: bump version to 1.30.1 by @​claude[bot] in #​2848

New Contributors

• @​MukundaKatta made their first contribution in #​1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

v1.30.0

Compare Source

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in #​1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in #​1839
• Add end-to-end test suite by @​felixweinberger in #​2167
• v1 stdio buffer limit by @​KKonstantinov in #​2239
• fix: support Zod 3.25 method literals by @​mattzcarey in #​2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in #​2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in #​2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in #​2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in #​2547
• chore: bump version to 1.30.0 by @​felixweinberger in #​2563

New Contributors

• @​mozmo15 made their first contribution in #​1503
• @​arimu1 made their first contribution in #​2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

v1.29.0

Compare Source

What's Changed

• fix: treat v1.x as primary branch for npm latest tag (backport #​1577) by @​felixweinberger in #​1749
• [v1.x] fix: disallow null (infinite) requested TTL by @​LucaButBoring in #​1339
• [v1.x] fix: add missing size field to ResourceSchema by @​olaservo in #​1575
• Add typings exports by @​tdraier in #​1623
• v1.x npm audit fix by @​KKonstantinov in #​1780
• v1.x #​1623 follow up -add missing types to package.json by @​KKonstantinov in #​1773
• [v1.x backport] Allow servers / clients to advertise extensions in the capability object by @​localden in #​1811
• fix(stdio): always set windowsHide on Windows, not just in Electron by @​jnMetaCode in #​1640
• chore: bump version to 1.29.0 by @​felixweinberger in #​1820

New Contributors

• @​tdraier made their first contribution in #​1623
• @​jnMetaCode made their first contribution in #​1640

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

Compare Source

What's Changed

• feat: use scopes_supported from resource metadata by default (fixes #​580) by @​antogyn in #​757
• [v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by @​pcarleton in #​1611
• fix: reject plain JSON Schema objects passed as inputSchema by @​tiluckdave in #​1596
• fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by @​pcarleton in #​1462
• fix(server/auth): RFC 8252 loopback port relaxation by @​poteat in #​1738
• chore: bump version to 1.28.0 by @​felixweinberger in #​1746

New Contributors

• @​antogyn made their first contribution in #​757
• @​tiluckdave made their first contribution in #​1596
• @​poteat made their first contribution in #​1738

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

Compare Source

What's Changed

• feat: implement auth/pre-registration conformance scenario by @​felixweinberger in #​1545
• docs: add governance documentation for SEP-1730 by @​felixweinberger in #​1547
• docs: comprehensive feature documentation for SEP-1730 Tier 1 by @​felixweinberger in #​1548
• fix: prevent command injection in example URL opening (v1.x backport) by @​maxisbey in #​1579
• fix: call onerror for silently swallowed transport errors by @​qing-ant in #​1580
• chore: bump version to 1.27.1 by @​felixweinberger in #​1581

New Contributors

• @​qing-ant made their first contribution in #​1580

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

Compare Source

What's Changed

• feat: add conformance test infrastructure for v1.x by @​felixweinberger in #​1518
• feat: backport discoverOAuthServerInfo() and discovery caching to v1.x by @​felixweinberger in #​1533
• feat: add url property to RequestInfo interface by @​valentinbeggi in #​1353
• [v1.x] feat(tasks): add streaming methods for elicitation and sampling by @​LucaButBoring in #​1528
• chore: bump version for v1.27.0 by @​felixweinberger in #​1541

New Contributors

• @​valentinbeggi made their first contribution in #​1353

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

v1.26.0

Compare Source

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

• chore: bump v1.25.3 for backport fixes by @​pcarleton in #​1412
• fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x backport) by @​samuv in #​1382
• Fix #​1430: Client Credentials providers scopes support (backported) by @​NSeydoux in #​1442
• chore: bump version to 1.26.0 by @​pcarleton in #​1479

New Contributors

• @​samuv made their first contribution in #​1382
• @​NSeydoux made their first contribution in #​1442

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

v1.25.3

Compare Source

What's Changed

• [v1.x backport] Use correct schema for client sampling validation when tools are present by @​olaservo in #​1407
• fix: prevent Hono from overriding global Response object (v1.x) by @​mattzcarey in #​1411

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.2...v1.25.3

v1.25.2

Compare Source

What's Changed

• ci: trigger workflow on v1.x branch by @​felixweinberger in #​1319
• fix: README badges links destinations by @​antonpk1 in #​907
• fix: prevent ReDoS in UriTemplate regex patterns (v1.x backport) by @​pcarleton in #​1365

New Contributors

• @​antonpk1 made their first contribution in #​907

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.1...v1.25.2

v1.25.1

Compare Source

What's Changed

• spec types - backwards compatibility changes by @​KKonstantinov in #​1306
• chore: bump version for patch fix by @​felixweinberger in #​1307

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.0...1.25.1

v1.25.0

Compare Source

What's Changed

• list changed handlers on client constructor by @​mattzcarey in #​1206
• Role - moved from inline to reusable type by @​KKonstantinov in #​1221
• fix: use versioned npm tag for non-main branch releases by @​pcarleton in #​1236
• No automatic completion support unless needed - Revisited yet again by @​cliffhall in #​1237
• fix: Support updating output schema by @​vincent0426 in #​1048
• Remove type dependency on @​cfworker/json-schema by @​LucaButBoring in #​1229
• Relocate tests under /test by @​KKonstantinov in #​1220
• Fix tsconfig: remove tests by @​KKonstantinov in #​1240
• tsconfig - tests and build fix by @​KKonstantinov in #​1243
• fix a typo in examples README by @​DaleSeo in #​1246
• Protocol date validation by @​mattzcarey in #​1247
• Flaky test fix on Types.test.ts by @​KKonstantinov in #​1244
• SPEC COMPLIANCE: Remove loose/passthrough types not allowed/defined by MCP spec + Task types by @​KKonstantinov in #​1242
• Follow-up fixes for PR #​1242 by @​felixweinberger in #​1274
• Update server examples and docs by @​DaleSeo in #​1285
• Update TypeScript config to ES2020 to fix AJV imports by @​mattzcarey in #​1297
• Fix Zod v4 schema description extraction by @​felixweinberger in #​1296
• Add optional description field to Implementation schema by @​calclavia in #​1295
• Add theme property to Icon schema by @​DaleSeo in #​1290
• feat: fetch transport by @​mattzcarey in #​1209
• chore: bump version for release by @​felixweinberger in #​1301

New Contributors

• @​vincent0426 made their first contribution in #​1048

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.3...1.25.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b8bfddf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 5 workspace projects
 ERR_PNPM_WORKSPACE_PKG_NOT_FOUND  In : "@codex-native/sdk@workspace:*" is in the dependencies but no package named "@codex-native/sdk" is present in the workspace

This error happened while installing a direct dependency of /tmp/renovate/repos/github/ScriptedAlchemy/codex-native

Packages found in the workspace: 
Progress: resolved 1, reused 0, downloaded 0, added 0