[dependabot]

Bumps mcp from 1.6.0 to 1.8.1.

Release notes

Sourced from mcp's releases.

v1.8.1

This release brings the server's JSON-RPC framing and capability advertisement, and the HTTP client's handling of an initialize answered over SSE, in line with the MCP specification. The Changed entries alter answers on the wire, as fixes of incorrect conformance under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md. Only senders of null ids and client code that read the error event of a 4xx or 5xx SSE answer, which the client now raises as RequestHandlerError, have to change. A stdio server also survives a frame it cannot strip, parse or answer.

Changed

• Refuse a request whose id is null and do not run a request method sent without an id (#612)
• Leave the id out of an error response when the request id cannot be read (#615)
• Return from initialize as soon as its SSE response arrives and raise on an error-status SSE answer in the HTTP client (#617)
• Leave listChanged and subscribe out of a stateless server's initialize result (#620)

Fixed

• Answer a method of an undeclared capability with Method not found (#611)
• Accept any string as a request id (#613)
• Ignore empty members of the Accept header (#616)
• Keep Ruby 2.7 from warning about keywords in StdioTransport (#621)
• Keep the stdio server running when a reply cannot be encoded (#623)
• Treat a JSON key that is not valid UTF-8 as a parse error (#624)
• Strip stdio frames as bytes (#625)

v1.8.0

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

v1.7.0

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

... (truncated)

Changelog

Sourced from mcp's changelog.

[1.8.1] - 2026-10-21

This release brings the server's JSON-RPC framing and capability advertisement, and the HTTP client's handling of an initialize answered over SSE, in line with the MCP specification. The Changed entries alter answers on the wire, as fixes of incorrect conformance under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md. Only senders of null ids and client code that read the error event of a 4xx or 5xx SSE answer, which the client now raises as RequestHandlerError, have to change. A stdio server also survives a frame it cannot strip, parse or answer.

Changed

• Refuse a request whose id is null and do not run a request method sent without an id (#612)
• Leave the id out of an error response when the request id cannot be read (#615)
• Return from initialize as soon as its SSE response arrives and raise on an error-status SSE answer in the HTTP client (#617)
• Leave listChanged and subscribe out of a stateless server's initialize result (#620)

Fixed

• Answer a method of an undeclared capability with Method not found (#611)
• Accept any string as a request id (#613)
• Ignore empty members of the Accept header (#616)
• Keep Ruby 2.7 from warning about keywords in StdioTransport (#621)
• Keep the stdio server running when a reply cannot be encoded (#623)
• Treat a JSON key that is not valid UTF-8 as a parse error (#624)
• Strip stdio frames as bytes (#625)

[1.8.0] - 2026-10-16

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)

... (truncated)

Commits

• 0e59bb4 Merge pull request #626 from koic/release_1_8_1
• 0b3f02d Release 1.8.1
• 9e2b3f7 Merge pull request #625 from koic/strip_stdio_frames_as_bytes
• d280b57 Strip stdio frames as bytes
• 6d7b3c4 Merge pull request #624 from koic/treat_a_json_key_that_is_not_valid_utf_8_as...
• c8e8b62 Merge pull request #623 from koic/keep_the_stdio_server_running_when_a_reply_...
• 54a6470 Merge pull request #620 from koic/leave_list_changed_out_of_initialize_on_a_s...
• 16a82a0 Keep the stdio server running when a reply cannot be encoded
• 0814e7a Treat a JSON key that is not valid UTF-8 as a parse error
• 4559336 Merge pull request #616 from koic/ignore_empty_members_of_the_accept_header
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)