[dependabot]

Bumps mcp from 1.7.0 to 1.8.2.

Release notes

Sourced from mcp's releases.

v1.8.2

This release finishes the encoding fixes of 1.8.1 on the client and the HTTP transport, which no longer fail a request or a stream on a frame or a reply they cannot encode. The Changed entry alters what a subscriptions/listen stream honors under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a resources_subscribe_handler that raises for a URI now narrows the acknowledgement, and the handler runs for listen streams without a matching resources_unsubscribe_handler call.

Changed

• Consult the resources_subscribe_handler for the resource URIs of a subscriptions/listen stream (#632)

Fixed

• Strip stdio client frames as bytes (#627)
• Skip a stdio ping whose id cannot be encoded (#628)
• Answer an HTTP request whose reply cannot be generated with Internal error (#629)
• Drop a buffered notification that cannot be generated (#630)
• Report failed session notifications through the server configuration (#631)

v1.8.1

This release brings the server's JSON-RPC framing and capability advertisement, and the HTTP client's handling of an initialize answered over SSE, in line with the MCP specification. The Changed entries alter answers on the wire, as fixes of incorrect conformance under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md. Only senders of null ids and client code that read the error event of a 4xx or 5xx SSE answer, which the client now raises as RequestHandlerError, have to change. A stdio server also survives a frame it cannot strip, parse or answer.

Changed

• Refuse a request whose id is null and do not run a request method sent without an id (#612)
• Leave the id out of an error response when the request id cannot be read (#615)
• Return from initialize as soon as its SSE response arrives and raise on an error-status SSE answer in the HTTP client (#617)
• Leave listChanged and subscribe out of a stateless server's initialize result (#620)

Fixed

• Answer a method of an undeclared capability with Method not found (#611)
• Accept any string as a request id (#613)
• Ignore empty members of the Accept header (#616)
• Keep Ruby 2.7 from warning about keywords in StdioTransport (#621)
• Keep the stdio server running when a reply cannot be encoded (#623)
• Treat a JSON key that is not valid UTF-8 as a parse error (#624)
• Strip stdio frames as bytes (#625)

v1.8.0

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

... (truncated)

Changelog

Sourced from mcp's changelog.

[1.8.2] - 2026-10-27

This release finishes the encoding fixes of 1.8.1 on the client and the HTTP transport, which no longer fail a request or a stream on a frame or a reply they cannot encode. The Changed entry alters what a subscriptions/listen stream honors under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md: a resources_subscribe_handler that raises for a URI now narrows the acknowledgement, and the handler runs for listen streams without a matching resources_unsubscribe_handler call.

Changed

• Consult the resources_subscribe_handler for the resource URIs of a subscriptions/listen stream (#632)

Fixed

• Strip stdio client frames as bytes (#627)
• Skip a stdio ping whose id cannot be encoded (#628)
• Answer an HTTP request whose reply cannot be generated with Internal error (#629)
• Drop a buffered notification that cannot be generated (#630)
• Report failed session notifications through the server configuration (#631)

[1.8.1] - 2026-10-21

This release brings the server's JSON-RPC framing and capability advertisement, and the HTTP client's handling of an initialize answered over SSE, in line with the MCP specification. The Changed entries alter answers on the wire, as fixes of incorrect conformance under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md. Only senders of null ids and client code that read the error event of a 4xx or 5xx SSE answer, which the client now raises as RequestHandlerError, have to change. A stdio server also survives a frame it cannot strip, parse or answer.

Changed

• Refuse a request whose id is null and do not run a request method sent without an id (#612)
• Leave the id out of an error response when the request id cannot be read (#615)
• Return from initialize as soon as its SSE response arrives and raise on an error-status SSE answer in the HTTP client (#617)
• Leave listChanged and subscribe out of a stateless server's initialize result (#620)

Fixed

• Answer a method of an undeclared capability with Method not found (#611)
• Accept any string as a request id (#613)
• Ignore empty members of the Accept header (#616)
• Keep Ruby 2.7 from warning about keywords in StdioTransport (#621)
• Keep the stdio server running when a reply cannot be encoded (#623)
• Treat a JSON key that is not valid UTF-8 as a parse error (#624)
• Strip stdio frames as bytes (#625)

[1.8.0] - 2026-10-16

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750

... (truncated)

Commits

• ac8e5af Merge pull request #634 from koic/release_1_8_2
• f8fbeb7 Merge pull request #633 from koic/refine_the_token_endpoint_error_docs
• ab55a8e Release 1.8.2
• 26eabbc Merge pull request #632 from koic/authorize_the_resource_subscriptions_of_a_l...
• de9d539 [Doc] Bound the token endpoint error docs to what sets the readers
• fc41dae Merge pull request #631 from koic/report_failed_session_notifications_through...
• 52edb18 Consult the resources_subscribe_handler for listen resource URIs
• ec6501b Merge pull request #630 from koic/drop_a_buffered_notification_that_cannot_be...
• 89772bf Drop a buffered notification that cannot be generated
• a7bd967 Report failed session notifications through the server configuration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)