chore(deps): bump mcp-handler from 1.1.0 to 2.1.1

[dependabot]

Bumps mcp-handler from 1.1.0 to 2.1.1.

Release notes

Sourced from mcp-handler's releases.

v2.1.1

Patch Changes

• e38a932: Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams.

v2.1.0

Minor Changes

• 8398dbd: createMcpHandler(initialize, serverOptions, config) is now createMcpHandler(initialize, options) — a single options object combining the SDK's ServerOptions with serverInfo, verboseLogs, and onEvent (exported as McpHandlerOptions). The deprecated 1.x compatibility shims (basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, sessionIdGenerator) are removed.

v2.0.1

Patch Changes

• e6e6378: Mount the MCP handler directly at a framework route and remove legacy transport endpoint routing. The CLI now generates app/api/mcp/route.ts; deprecated route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims.

v2.0.0

Major Changes

• 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

  • The handler now serves the stateless 2026-07-28 protocol (per-request _meta envelope, server/discover) natively, with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
  • Breaking: requires @modelcontextprotocol/server ^2.0.0 (replaces the @modelcontextprotocol/sdk peer dependency), zod ^4.2.0 for schemas, and Node.js 20+.
  • Breaking: the legacy HTTP+SSE transport (protocol 2024-11-05) has been removed. /sse and /message endpoints answer 410 Gone; the redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops.
  • Breaking: tool/prompt/resource registration follows SDK v2 (registerTool with z.object(...) Standard Schemas; variadic server.tool(...) is gone; extra.authInfo is now ctx.http?.authInfo).
  • withMcpAuth now builds its 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse, keeping RFC 9728 resource_metadata discovery in place for CIMD-era authorization flows. Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents — see README.

Changelog

Sourced from mcp-handler's changelog.

2.1.1

Patch Changes

• e38a932: Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams.

2.1.0

Minor Changes

• 8398dbd: createMcpHandler(initialize, serverOptions, config) is now createMcpHandler(initialize, options) — a single options object combining the SDK's ServerOptions with serverInfo, verboseLogs, and onEvent (exported as McpHandlerOptions). The deprecated 1.x compatibility shims (basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, sessionIdGenerator) are removed.

2.0.1

Patch Changes

• e6e6378: Mount the MCP handler directly at a framework route and remove legacy transport endpoint routing. The CLI now generates app/api/mcp/route.ts; deprecated route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims.

2.0.0

Major Changes

• 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

  • The handler now serves the stateless 2026-07-28 protocol (per-request _meta envelope, server/discover) natively, with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
  • Breaking: requires @modelcontextprotocol/server ^2.0.0 (replaces the @modelcontextprotocol/sdk peer dependency), zod ^4.2.0 for schemas, and Node.js 20+.
  • Breaking: the legacy HTTP+SSE transport (protocol 2024-11-05) has been removed. /sse and /message endpoints answer 410 Gone; the redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops.
  • Breaking: tool/prompt/resource registration follows SDK v2 (registerTool with z.object(...) Standard Schemas; variadic server.tool(...) is gone; extra.authInfo is now ctx.http?.authInfo).
  • withMcpAuth now builds its 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse, keeping RFC 9728 resource_metadata discovery in place for CIMD-era authorization flows. Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents — see README.

Commits

• 7c8fe0a chore: update package versions (#185)
• e38a932 fix: forward maxSubscriptions to SDK handler (#184)
• 0e90b1f chore: update package versions (#180)
• 8398dbd feat: merge createMcpHandler options into a single object (#179)
• 060bc5f chore: update package versions (#177)
• e6e6378 refactor: simplify framework-mounted MCP routes (#176)
• 6f0cbe4 chore: update package versions (#174)
• 6d52b10 fix: publish releases with npm trusted publishing (#175)
• 451b79a fix: sign changesets release commits via GitHub API (#173)
• 33c06b6 feat!: upgrade to MCP SDK v2 and 2026-07-28 spec (#172)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mcp-handler since your current version.