[dependabot]

Bumps mcp from 1.6.0 to 1.7.0.

Release notes

Sourced from mcp's releases.

v1.7.0

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

v1.6.1

This release makes the OAuth client parse WWW-Authenticate headers and URLs in linear time and repairs the lifecycle of subscriptions/listen streams: same-id streams are served, a keepalive thread ends with its slot, and the acknowledgement precedes the closing result.

Fixed

• Replace authorization request parameters the endpoint URL already carries (#566)
• Serve subscriptions/listen streams that carry the same request id (#567)
• End a listen stream's keepalive thread when its slot is freed (#569)
• Parse the WWW-Authenticate challenge in linear time (#571)
• Keep the acknowledgement first when the transport closes during a listen registration (#574)
• Resolve dot segments in linear time when canonicalizing a URL (#575)

Changelog

Sourced from mcp's changelog.

[1.7.0] - 2026-10-05

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

[1.6.1] - 2026-09-27

This release makes the OAuth client parse WWW-Authenticate headers and URLs in linear time and repairs the lifecycle of subscriptions/listen streams: same-id streams are served, a keepalive thread ends with its slot, and the acknowledgement precedes the closing result.

Fixed

• Replace authorization request parameters the endpoint URL already carries (#566)
• Serve subscriptions/listen streams that carry the same request id (#567)
• End a listen stream's keepalive thread when its slot is freed (#569)
• Parse the WWW-Authenticate challenge in linear time (#571)
• Keep the acknowledgement first when the transport closes during a listen registration (#574)
• Resolve dot segments in linear time when canonicalizing a URL (#575)

Commits

• d4202c2 Merge pull request #588 from koic/release_1_7_0
• 6cb9875 Release 1.7.0
• 745bc61 Merge pull request #587 from koic/mark_removed_listen_streams_closed
• cc88656 Merge pull request #586 from koic/validate_icons_given_as_hashes
• 0cef024 Mark a removed subscriptions/listen stream closed
• 402cb56 Merge pull request #585 from koic/refuse_listen_requests_that_cannot_be_encoded
• 73d6da3 Merge pull request #584 from koic/describe_the_pending_authorization_checks_a...
• a49ab43 Validate icons given as Hashes through MCP::Icon
• 739dd55 Refuse subscriptions/listen requests that cannot be encoded
• 095bd81 [Doc] Describe the pending authorization checks as the code establishes them
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)