From 2b9bc78165f85aff0c1eec99c483af3e87dbe312 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 11:13:14 +0000
Subject: [PATCH] chore(deps): bump mcp-kotlin from 0.12.0 to 0.13.0 in
 /samples/kotlin-mcp-server (#823)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@​jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/6e6f80512fb8fcc9f3c031cfd693ccbcf9c4aaab">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/b7eeeb12058099f980fa98d1468506489a6b5f32"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/6e6f80512fb8fcc9f3c031cfd693ccbcf9c4aaab"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/0eb18228538c5410957e73933509fca2c00902c1"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/0adfb3bcdb06843a9da6617e0a50c604a6747339"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/37ee423308078a5daa57bb76953c79f1bcc6c7dc"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/ff4b6232ba1a107058f6243463c9f7298b52dd76"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/78066a9cf6970618ef72a8c9b48c8c2fca03c387"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/1ff5f003b657efef39e41f00591e693afa1757e0"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/6d5bac1e6792fc42ca476527df19c56f51666885"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/c8545606bb87faf7595dafa7269f31f5a5f75703"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@​jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/6e6f80512fb8fcc9f3c031cfd693ccbcf9c4aaab">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@​devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/b7eeeb12058099f980fa98d1468506489a6b5f32"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/6e6f80512fb8fcc9f3c031cfd693ccbcf9c4aaab"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/0eb18228538c5410957e73933509fca2c00902c1"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/0adfb3bcdb06843a9da6617e0a50c604a6747339"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/37ee423308078a5daa57bb76953c79f1bcc6c7dc"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/ff4b6232ba1a107058f6243463c9f7298b52dd76"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/78066a9cf6970618ef72a8c9b48c8c2fca03c387"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/1ff5f003b657efef39e41f00591e693afa1757e0"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/6d5bac1e6792fc42ca476527df19c56f51666885"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/kotlin-sdk/commit/c8545606bb87faf7595dafa7269f31f5a5f75703"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 samples/kotlin-mcp-server/gradle/libs.versions.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/kotlin-mcp-server/gradle/libs.versions.toml b/samples/kotlin-mcp-server/gradle/libs.versions.toml
index 165d096..bd87373 100644
--- a/samples/kotlin-mcp-server/gradle/libs.versions.toml
+++ b/samples/kotlin-mcp-server/gradle/libs.versions.toml
@@ -1,7 +1,7 @@
 [versions]
 kotlin = "2.3.21"
 ktor = "3.3.3"
-mcp-kotlin = "0.12.0"
+mcp-kotlin = "0.13.0"
 slf4j = "2.0.18"
 shadow = "9.4.2"