Skip to content

build(deps): Bump the gomod group across 1 directory with 2 updates - #105

Merged
ibakshay merged 1 commit into
mainfrom
dependabot/go_modules/gomod-92e120a0f0
Oct 9, 2026
Merged

build(deps): Bump the gomod group across 1 directory with 2 updates#105
ibakshay merged 1 commit into
mainfrom
dependabot/go_modules/gomod-92e120a0f0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gomod group with 2 updates in the / directory: github.com/modelcontextprotocol/go-sdk and github.com/perses/spec.

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

  • plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
  • blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

  • seterroroverwrite
  • enableoriginverification
  • disablecontenttypecheck

... (truncated)

Commits
  • 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
  • 830f0b7 mcp: update conformance tests (#1231)
  • 12cbafe oauthex: oauth discovery checks (#1220)
  • 3632967 mcp: add an sse event size cap (#1205)
  • 0d3036f mcp: allow per request Cacheable customization (#1203)
  • cb0de64 mcp: add a max request body size of the old transport (#1224)
  • 2fdabde mcp: do not check metatada on notifications (#1215)
  • 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
  • a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
  • 8227246 fix: only subscribe when server advertises capability (#1221)
  • Additional commits viewable in compare view

Updates github.com/perses/spec from 0.3.0-beta.5 to 0.3.0-beta.10

Release notes

Sourced from github.com/perses/spec's releases.

v0.3.0-beta.10

What's Changed

Full Changelog: perses/spec@v0.3.0-beta.9...v0.3.0-beta.10

v0.3.0-beta.9

What's Changed

New Contributors

Full Changelog: perses/spec@v0.3.0-beta.8...v0.3.0-beta.9

v0.3.0-beta.8

What's Changed

New Contributors

Full Changelog: perses/spec@v0.3.0-beta.7...v0.3.0-beta.8

v0.3.0-beta.7

What's Changed

Full Changelog: perses/spec@v0.3.0-beta.6...v0.3.0-beta.7

v0.3.0-beta.6

What's Changed

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 17, 2026
@dependabot dependabot Bot changed the title build(deps): Bump the gomod group with 2 updates build(deps): Bump the gomod group across 1 directory with 2 updates Sep 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-92e120a0f0 branch from 21ee663 to 5c5e6e4 Compare September 24, 2026 15:23
@ibakshay

ibakshay commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-92e120a0f0 branch from 5c5e6e4 to 6e54a04 Compare October 9, 2026 11:30
@ibakshay

ibakshay commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
build(deps): Bump the gomod group across 1 directory with 2 updates
28f8453 
Bumps the gomod group with 2 updates in the / directory: [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) and [github.com/perses/spec](https://github.com/perses/spec).


Updates `github.com/modelcontextprotocol/go-sdk` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.7.0...v1.8.0)

Updates `github.com/perses/spec` from 0.3.0-beta.5 to 0.3.0-beta.10
- [Release notes](https://github.com/perses/spec/releases)
- [Changelog](https://github.com/perses/spec/blob/main/RELEASE.md)
- [Commits](perses/spec@v0.3.0-beta.5...v0.3.0-beta.10)

---
updated-dependencies:
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/perses/spec
  dependency-version: 0.3.0-beta.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-92e120a0f0 branch from 6e54a04 to 28f8453 Compare October 9, 2026 11:35
@ibakshay
ibakshay added this pull request to the merge queue Oct 9, 2026
Merged via the queue into main with commit fa112be Oct 9, 2026
7 checks passed
@ibakshay
ibakshay deleted the dependabot/go_modules/gomod-92e120a0f0 branch October 9, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ibakshay ibakshay ibakshay approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ibakshay