Skip to content
This repository was archived by the owner on Apr 29, 2026. It is now read-only.

fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 - autoclosed - #72

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-modelcontextprotocol-go-sdk-1.x
Closed

fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 - autoclosed#72
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-modelcontextprotocol-go-sdk-1.x

Conversation

@renovate

@renovate renovate Bot commented Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/modelcontextprotocol/go-sdk v0.5.0 → v1.4.1 age confidence

Release Notes

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

v1.4.1

Compare Source

This release is a patch release for v1.4.0.

It contains cherry-picks for several security improvements. Security advisories will follow.

Fixes

Update of the segmentio/encoding module version

The JSON parsing library that was adopted to avoid attacks taking advantage of the Go's standard parser being case insensitive turned out to contain an issue itself. We have submitted the fix upstream and this release updates the dependency to the patched version.

Cross-origin requests protection

We have added additional protection against cross origin requests. From now on, we verify that Content-Type for JSON-RPC POST requests is set to application/json and use the new http.CrossOriginProtection functionality to verify the origin of the request. Usage of this functionality required increasing the required Go version to 1.25, which is in line with our Go version policy of supporting two newest Go versions. The behavior can be customized by passing a configured http.CrossOriginProtection object to StreamableHTTPOptions.

Since this is a behavior change, we introduced a compatibility parameter disablecrossoriginprotection that will allow to temporarily disable it. It will be removed in v1.6.0 version of the SDK. See here for more details about behavior changes and a history of compatibility parameters across SDK versions.

Allowing customization of http.Client for client-side OAuth

We have introduced an optional http.Client parameter to AuthorizationCodeHandlerConfig. This allows customization of the transport, for example implementing environment specific protection against Server-Side Request Forgery.

Pull requests

Full Changelog: modelcontextprotocol/go-sdk@v1.4.0...v1.4.1

v1.4.0

Compare Source

This release marks the completion of the full 2025-11-25 specification implementation, by introducing the support for Sampling with Tools and experimental client-side OAuth support. It also contains multiple bug fixes and improvements. Thanks to all contributors!

Client-side OAuth support

This release introduces experimental support for OAuth on the client side of the SDK. It aims to support the full scope of the current MCP specification for authorization. To use it, you need to compile the SDK with the -tags mcp_go_client_oauth flag. Some changes may still be applied to this new API, based on developer feedback. The functionality is planned to become stable in v1.5.0 release, expected by the end of March 2026. More details can be found at https://github.com/modelcontextprotocol/go-sdk/blob/main/docs/protocol.md#client.

Sampling with Tools

Starting from this release, the server use the new CreateMessageWithTools method to create a sampling request to the client that contains tools that can be used by the client. On the client side, CreateMessageWithToolsHandler may be used to handle such requests and issue ToolUse responses to the server.

Behavior changes

We have two important behavior changes that were introduced to fix a bug or improve security posture. They can be temporarily turned off by specifying a special MCPGODEBUG environment variable when running the SDK. Different options can be added together, separated by a comma.

Introduced DNS rebinding protection

The requests arriving via a localhost address (127.0.0.1, [::1]) that have a non-localhost Host header will be rejected to protect against DNS rebinding attacks. The protection can be disabled by specifying StreamableHTTPOptions.DisableLocalhostProtection, but it should be done only if security implications are understood (see documentation for the option).

This protection is a behavior change, as the protection is now enabled by default. Because of that, we have introduced an MCPGODEBUG option to bring back the previous default behavior for users that need more time to adjust. However, if possible, we recommend specifying DisableLocalhostProtection described above, as it is a more future-proof solution. The MCPGODEBUG option to remove this protection (disablelocalhostprotection=1) will be removed in v1.6.0.

Removed JSON content escaping when marshaling

By default encoding/json escapes the contents of the objects, which causes some servers to fail. We switched to no escaping by default, to be consistent with other SDKs. Since this is a behavior change, we introduced an MCPGODEBUG option to bring back the previous behavior for users that need more time to adjust to it. That option (jsonescaping=1) will be removed in v1.6.0.

Bug fixes

Security vulnerability caused by the case insensitive parsing behavior of encoding/json has been submitted (also release as a cherry pick in v1.3.1). Security advisory has been posted.

Other fixes:

Enhancements

Notably, the SDK now supports the extensions field in client and server capabilities, which should enable creation of MCP Apps.

Other enhancements:

Repository organization

Some effort was put into better organization of the repository, as well as making sure it's up to date and secure. As a highlight, the repository is not integrated with OSSF Scorecard with a positive score of 8.7. Additionally, the full conformance test suite is now run on every PR and push to main.

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.3.0...v1.4.0

v1.3.1

Compare Source

This release is a patch release for v1.3.0.

It contains a cherry-pick for a security issue reported in #​805, which takes advantage of the default behavior of Go's standard library JSON decoder that allows case-insensitive matches to struct field names (or "json" tags). The issue has been addressed by changing the JSON decoder to one that supports case sensitive matching.

Fixes

New external dependencies

Full Changelog: modelcontextprotocol/go-sdk@v1.3.0...v1.3.1

v1.3.0

Compare Source

This release is equivalent to v1.3.0-pre.1. Thank you to those who tested the pre-release.

This release includes several enhancements and bugfixes. Worth mentioning is the addition of schema caching, which significantly improves the performance in some stateless server deployment scenarios.

Dependency updates

Enhancements

Bugfixes

Chores

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.2.0...v1.3.0

v1.2.0

Compare Source

This release is equivalent to v1.2.0-pre.2. Thank you to those who tested the prerelease.

This release adds partial support for the 2025-11-25 version of the MCP spec and fixes some bugs in the streamable transports. It also includes some minor new APIs, changes to contributing flows, and small bugfixes.

Contributing changes

  • CONTRIBUTING.md is updated to remove the ad-hoc antitrust policy (#​651), and add a dependency update policy (#​635).
  • An example server (examples/server/conformance) is added for the new conformance tests at modelcontextprotocol/conformance. Test can be run with scripts/conformance.sh (#​650).

Partial support for the 2025-11-25 spec

The following SEPs from the 2025-11-25 spec are now supported. Please see #​725 for the proposed API additions included to support these SEPs.

  • SEP-973: icons and metadata (#​570)
  • SEP-986: tool name validation (#​640)
  • SEP-1024: elicitation defaults (#​644)
  • SEP-1036: URL mode elicitation (#​646)
  • SEP-1699: SSE polling (#​663)
  • SEP-1330: elicitation enum improvements (#​676)

Other API additions

  • Common error codes are now available through the sentinel jsonrpc.Error (#​452)
  • OAuth 2.0 Protected Resource Metadata support (#​643)
  • ClientCapabilities.RootsV2 and RootCapabilities are added to work around an API bug (#​607)
  • Capabilities fields are added to ServerOptions and ClientOptions, to simplify capability configuration (#​706)

Streamable fixes

Several bug fixes are included for the streamable transports:

Other notable bugfixes

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.1.0...v1.2.0

v1.1.0

Compare Source

This release introduces a few new features, and includes improvements and bug fixes for the streamable transport. Notably, the default behavior of the streamable server transport is changed to disable streams resumption (see #​580).

Behavior Changes

Stream resumption disabled by default. In the StreamableServerTransport, the default value of nil for the EventStore field now disables stream resumption, rather than defaulting to use an in-memory event store. Resumption is not desirable in many cases, particularly for servers that must serve a large number of users and/or streams.

If you want to enable resumption, set StreamableHTTPOptions.EventStore.

In general, we will avoid changing behaviors that may be relied upon by users, but in this case the old default was deemed to be an oversight/bug, and fixing it now will benefit future users.

API Additions

  • IOTransport is a new general-purpose transport constructed from an io.ReadCloser and io.WriteCloser (#​444 ).
  • ServerOptions.Logger and StreamableHTTPOptions.Logger enable server-side logging (#​170).
  • StreamableHTTPOptions.EventStore enables stream resumption (#​587).
  • StreamableHTTPOptions.SessionTimeout adds a timeout which, when set, causes idle sessions to be automatically closed (#​499).

Experimental client-side oauth support

The auth package now includes experimental APIs when build with the mcp_go_client_oauth build tag. See auth/client.go for more details. These APIs may change before their official release.

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.0.0...v1.1.0

v1.0.0

Compare Source

This is a stable release of the Go SDK.

This release is functionally equivalent to v0.8.0, but formalizes a compatibility guarantee: going forward we won’t make breaking API changes. The API we have is not perfect, but it’s important that we commit to supporting it so that others can depend on the SDK without further churn. If we want to improve the current API in the future, we’ll do so in backward compatible ways, such as by deprecating and adding. For example, #​396, #​460 and #​533 propose new functions that improve the ergonomics of the current API. Given the rate of change of the MCP spec, it seems likely that we’ll want to go to v2 at some point, but we should delay that event for as long as possible.

This release also marks a level of relative completeness. You should be able to implement essentially any behavior described in the MCP spec using the SDK (except client-side OAuth—see #​19). See our feature documentation for information on how the SDK models different aspects of the spec.

Finally, this release represents a certain level of maturity. With the help of our contributors, we’ve endeavored to be responsive to bug reports, and as of writing have fixed 60 out of 61 bugs that have been reported against the SDK. Furthermore, the SDK is getting real-world usage both at Google and in the broader Go community. Much of this usage appears to be using the simpler stdio or sse transports; we anticipate further bug reports and feature requests as the SDK is used in larger, distributed streamable servers.

We owe a great deal of thanks to everyone who has filed bugs or contributed to the SDK. To date, we’ve accepted PRs from 58 distinct contributors, and many more people have filed issues or commented. We’d also like to thank those who have helped maintain the many other SDKs that compose the Go MCP ecosystem.

The plan now is to pay close attention to incoming bug reports, finalize client-side OAuth support, revisit our current set of proposals, and prepare for the next version of the MCP spec. Please use the SDK and continue to file issues. Thanks again!

What's Changed

Not much has changed since v0.8.0, though notably #​539 partially addresses the security issue described in #​526 (see also https://verialabs.com/blog/from-mcp-to-shell).

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v0.8.0...v1.0.0

v0.8.0

Compare Source

This release exists to include the API change from #​518, mentioned in the v0.7.0 release. It also includes a small change to remove extraneous API.

This concludes our API audit. Barring a realization over the weekend, we will cut v1.0.0 and any further API changes will be handled in a backwards compatible way.

API Changes

  • #​518: JSON schema fields are relaxed to type any, to decouple the SDK's API from the github.com/google/jsonschema-go/jsonschema package. Now that package is only used for inference (in mcp.AddTool) and validation.
  • #​535: remove error code constants that were functionally inaccessible.

Full Changelog: modelcontextprotocol/go-sdk@v0.7.0...v0.8.0

v0.7.0

Compare Source

This release fixes a couple bugs related to the StreamableClientTransport, and relaxes it to be less strict so that it can talk to certain servers that don't perfectly conform to the spec. It also updates to google/[email protected], which includes a couple backwards incompatible bug fixes (see below).

For more details, see the v0.7.0 milestone.

API Changes

No changes in the API of the SDK itself, but the updated google/jsonschema-go@​v0.3.0 contained the following incompatible bug fixes:

  • google/jsonschema-go#26: the key for ForOptions.TypeSchemas must be a reflect.Type, as incomparable values are not valid map keys.
  • google/jsonschema-go#23: validation of struct values is disallowed, because it can't verify certain schema properties such as 'required', and doesn't respect custom JSON marshalling

See #​518 for a proposal to significantly decouple the SDK from the jsonschema-go package (though it would still be used for inference and validation). This decision blocks the v1.0.0 release.

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v0.6.0...v0.7.0

v0.6.0

Compare Source

This release makes a couple minor API tweaks that arose in preparation for v1.0.0, and adds significant feature documentation in the docs/ directory.

This is a release candidate, and all release blocking issues have now been addressed. We will tag v1.0.0 following a final audit (see also #​328).

For more details, see the v0.6.0 milestone.

API Changes

  • Remove the distinguished StreamID type, which was inconsistent with (for example) session IDs, which are strings (#​484).
  • Moved GetSessionID onto ServerOptions, as that is more generally useful, and since ServerSession exposes an ID method (#​478).
  • Added options for the SSE HTTP handler (#​503). The SSE transport is legacy, but it was still inconsistent that this constructor did not accept options.

Bug fixes

  • Unstructured content is now byte-wise equivalent to structured content (#​475).
  • A few performance optimizations were made for streamable HTTP serving (capping off #​190).

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v0.5.0...v0.6.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch 2 times, most recently from c90c6ed to 3a7a5f0 Compare October 6, 2025 08:00
@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch from 3a7a5f0 to 10d94e4 Compare October 30, 2025 16:35
@renovate renovate Bot changed the title fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 - autoclosed Nov 10, 2025
@renovate renovate Bot closed this Nov 10, 2025
@renovate
renovate Bot deleted the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch November 10, 2025 23:49
@renovate renovate Bot changed the title fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 - autoclosed fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 Nov 11, 2025
@renovate renovate Bot reopened this Nov 11, 2025
@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch 2 times, most recently from 10d94e4 to a560813 Compare November 11, 2025 04:54
@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch 3 times, most recently from 43df6e2 to 3b9529c Compare December 22, 2025 16:37
@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch from 3b9529c to e12a866 Compare February 9, 2026 21:51
@renovate

renovate Bot commented Feb 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.24.5 -> 1.25.0
github.com/google/jsonschema-go v0.3.0 -> v0.4.2
golang.org/x/sys v0.37.0 -> v0.40.0

@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch from e12a866 to bbcc97a Compare February 18, 2026 18:53
@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch from bbcc97a to d765e7d Compare February 27, 2026 17:10
@renovate
renovate Bot force-pushed the renovate/github.com-modelcontextprotocol-go-sdk-1.x branch from d765e7d to c9496db Compare March 13, 2026 15:08
@renovate renovate Bot changed the title fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1 - autoclosed Mar 20, 2026
@renovate renovate Bot closed this Mar 20, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants