Bumps `kotlin` from 2.3.21 to 2.4.0.
Updates `org.jetbrains.kotlin.jvm` from 2.3.21 to 2.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/releases">org.jetbrains.kotlin.jvm's
releases</a>.</em></p>
<blockquote>
<h2>Kotlin 2.4.0</h2>
<h2>Changelog</h2>
<h3>Analysis API</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83867"><code>KT-83867</code></a>
OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ
repo</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83723"><code>KT-83723</code></a>
[Analysis API] Enable experimental KDoc resolver by default</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83388"><code>KT-83388</code></a>
Analysis API: properly support KMP in KotlinPackageProvider</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-65683"><code>KT-65683</code></a>
Analysis API: Dangling file session creation causes a
<code>computeIfAbsent</code> contract violation</li>
</ul>
<h3>Analysis API. Code Compilation</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-78946"><code>KT-78946</code></a>
Evaluation of variable with local class in type parameter leads to
InventNamesForLocalClasses exception</li>
</ul>
<h3>Analysis API. FIR</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-68260"><code>KT-68260</code></a>
K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION
with text <code>::lam1</code>, unexpected element of type: no element
found” with illegal callable reference call</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-70896"><code>KT-70896</code></a>
AA: False positive deprecation warning with override of built-in method
in JDK mapped class</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84711"><code>KT-84711</code></a>
K2 IDE sometimes loses FIR plugin-generated declarations after file
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84625"><code>KT-84625</code></a>
Analysis API: collectDesignationPath fails for nested classes inside
plugin-generated top-level classes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84596"><code>KT-84596</code></a>
Improve K2 Jooq completion performance</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84525"><code>KT-84525</code></a>
KaValueParameterSymbol#getHasSynthesizedName returns false for
FirDeclarationOrigin.SubstitutionOverride.DeclarationSite</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83546"><code>KT-83546</code></a>
Kotlin analysis reach ClsCustomNavigationPolicy</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84259"><code>KT-84259</code></a>
Move CommonDefaultImportsProvider to the frontend independent
module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82945"><code>KT-82945</code></a>
Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected
FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71135"><code>KT-71135</code></a>
AA: exception from sealed inheritors checker when
<code>analyzeCopy</code></li>
</ul>
<h3>Analysis API. Infrastructure</h3>
<h4>Fixes</h4>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83905"><code>KT-83905</code></a>
Analysis API: Improve UX with test data</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84913"><code>KT-84913</code></a>
Extract compiler classes used by the PSI & Analysis API to a
separate module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-64986"><code>KT-64986</code></a>
Analysis API: Implement Analysis API tests for different KMP
Platforms</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84776"><code>KT-84776</code></a>
The test data manager misses the redundancy check in the update
mode</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84962"><code>KT-84962</code></a>
The test data manager misses -ea flag</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84388"><code>KT-84388</code></a>
Preserve the EOF status in the test data manager to avoid extra
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84362"><code>KT-84362</code></a>
Analysis API tests produce many warnings due to "not yet loaded
registry"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84279"><code>KT-84279</code></a>
Test Data Manager fails on a clean build</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83913"><code>KT-83913</code></a>
Exclude compiler-based Analysis API tests from Git tracking</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-80379"><code>KT-80379</code></a>
Extract per-module test generators for AA tests</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84120"><code>KT-84120</code></a>
Move CLI modules out of kotlin-compiler-fe10-for-ide</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83200"><code>KT-83200</code></a>
Track external dependencies of the Analysis API modules</li>
</ul>
<h3>Analysis API. Light Classes</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82434"><code>KT-82434</code></a>
Light classes should prefer enum entries to properties</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84200"><code>KT-84200</code></a>
SLC: return type is not boxed for delegated methods with generic
original method</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-72451"><code>KT-72451</code></a>
"CCE: class PsiPrimitiveType cannot be cast to class
PsiClassType" with same-named enum class and typealias</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md">org.jetbrains.kotlin.jvm's
changelog</a>.</em></p>
<blockquote>
<h2>2.4.0</h2>
<h3>Analysis API</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83867"><code>KT-83867</code></a>
OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ
repo</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83723"><code>KT-83723</code></a>
[Analysis API] Enable experimental KDoc resolver by default</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83388"><code>KT-83388</code></a>
Analysis API: properly support KMP in KotlinPackageProvider</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-65683"><code>KT-65683</code></a>
Analysis API: Dangling file session creation causes a
<code>computeIfAbsent</code> contract violation</li>
</ul>
<h3>Analysis API. Code Compilation</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-78946"><code>KT-78946</code></a>
Evaluation of variable with local class in type parameter leads to
InventNamesForLocalClasses exception</li>
</ul>
<h3>Analysis API. FIR</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-68260"><code>KT-68260</code></a>
K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION
with text <code>::lam1</code>, unexpected element of type: no element
found” with illegal callable reference call</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-70896"><code>KT-70896</code></a>
AA: False positive deprecation warning with override of built-in method
in JDK mapped class</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84711"><code>KT-84711</code></a>
K2 IDE sometimes loses FIR plugin-generated declarations after file
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84625"><code>KT-84625</code></a>
Analysis API: collectDesignationPath fails for nested classes inside
plugin-generated top-level classes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84596"><code>KT-84596</code></a>
Improve K2 Jooq completion performance</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84525"><code>KT-84525</code></a>
KaValueParameterSymbol#getHasSynthesizedName returns false for
FirDeclarationOrigin.SubstitutionOverride.DeclarationSite</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83546"><code>KT-83546</code></a>
Kotlin analysis reach ClsCustomNavigationPolicy</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84259"><code>KT-84259</code></a>
Move CommonDefaultImportsProvider to the frontend independent
module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82945"><code>KT-82945</code></a>
Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected
FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71135"><code>KT-71135</code></a>
AA: exception from sealed inheritors checker when
<code>analyzeCopy</code></li>
</ul>
<h3>Analysis API. Infrastructure</h3>
<h4>Fixes</h4>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83905"><code>KT-83905</code></a>
Analysis API: Improve UX with test data</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84913"><code>KT-84913</code></a>
Extract compiler classes used by the PSI & Analysis API to a
separate module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-64986"><code>KT-64986</code></a>
Analysis API: Implement Analysis API tests for different KMP
Platforms</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84776"><code>KT-84776</code></a>
The test data manager misses the redundancy check in the update
mode</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84962"><code>KT-84962</code></a>
The test data manager misses -ea flag</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84388"><code>KT-84388</code></a>
Preserve the EOF status in the test data manager to avoid extra
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84362"><code>KT-84362</code></a>
Analysis API tests produce many warnings due to "not yet loaded
registry"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84279"><code>KT-84279</code></a>
Test Data Manager fails on a clean build</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83913"><code>KT-83913</code></a>
Exclude compiler-based Analysis API tests from Git tracking</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-80379"><code>KT-80379</code></a>
Extract per-module test generators for AA tests</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84120"><code>KT-84120</code></a>
Move CLI modules out of kotlin-compiler-fe10-for-ide</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83200"><code>KT-83200</code></a>
Track external dependencies of the Analysis API modules</li>
</ul>
<h3>Analysis API. Light Classes</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82434"><code>KT-82434</code></a>
Light classes should prefer enum entries to properties</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84200"><code>KT-84200</code></a>
SLC: return type is not boxed for delegated methods with generic
original method</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-72451"><code>KT-72451</code></a>
"CCE: class PsiPrimitiveType cannot be cast to class
PsiClassType" with same-named enum class and typealias</li>
</ul>
<h3>Analysis API. PSI</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="add726ca8c"><code>add726c</code></a>
Add ChangeLog for 2.4.0-RC2</li>
<li><a
href="69a4a81ef2"><code>69a4a81</code></a>
[Wasm] Add binaryen per-file arguments</li>
<li><a
href="8907c635d4"><code>8907c63</code></a>
[KGP] Suppress duplicate compiler warning output when --warning-mode=all
is a...</li>
<li><a
href="f9bef128ea"><code>f9bef12</code></a>
[KGP] Add failing test for duplicate compiler warning output via
Problems API</li>
<li><a
href="7fe49c227a"><code>7fe49c2</code></a>
KT-86268: Use 2.4.0 toolchain for abiValidation with older CVs</li>
<li><a
href="13d25e2c58"><code>13d25e2</code></a>
KT-86268: Regression test added</li>
<li><a
href="f7d1a76541"><code>f7d1a76</code></a>
[JKlib] Fix JAR deserializer configuration.</li>
<li><a
href="5cec663aff"><code>5cec663</code></a>
[JKlib] Wire up JvmBuiltInClassDescriptorFactory</li>
<li><a
href="ef146114de"><code>ef14611</code></a>
Make the default stability of non-final classes <code>Unknown</code>
instead of <code>Stable</code></li>
<li><a
href="d76473afd2"><code>d76473a</code></a>
[Gradle] Fix GeneralNativeIT.shouldAllowToOverrideDownloadUrl test
failures</li>
<li>Additional commits viewable in <a
href="https://github.com/JetBrains/kotlin/compare/v2.3.21...v2.4.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `org.jetbrains.kotlin.plugin.serialization` from 2.3.21 to 2.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/releases">org.jetbrains.kotlin.plugin.serialization's
releases</a>.</em></p>
<blockquote>
<h2>Kotlin 2.4.0</h2>
<h2>Changelog</h2>
<h3>Analysis API</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83867"><code>KT-83867</code></a>
OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ
repo</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83723"><code>KT-83723</code></a>
[Analysis API] Enable experimental KDoc resolver by default</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83388"><code>KT-83388</code></a>
Analysis API: properly support KMP in KotlinPackageProvider</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-65683"><code>KT-65683</code></a>
Analysis API: Dangling file session creation causes a
<code>computeIfAbsent</code> contract violation</li>
</ul>
<h3>Analysis API. Code Compilation</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-78946"><code>KT-78946</code></a>
Evaluation of variable with local class in type parameter leads to
InventNamesForLocalClasses exception</li>
</ul>
<h3>Analysis API. FIR</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-68260"><code>KT-68260</code></a>
K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION
with text <code>::lam1</code>, unexpected element of type: no element
found” with illegal callable reference call</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-70896"><code>KT-70896</code></a>
AA: False positive deprecation warning with override of built-in method
in JDK mapped class</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84711"><code>KT-84711</code></a>
K2 IDE sometimes loses FIR plugin-generated declarations after file
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84625"><code>KT-84625</code></a>
Analysis API: collectDesignationPath fails for nested classes inside
plugin-generated top-level classes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84596"><code>KT-84596</code></a>
Improve K2 Jooq completion performance</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84525"><code>KT-84525</code></a>
KaValueParameterSymbol#getHasSynthesizedName returns false for
FirDeclarationOrigin.SubstitutionOverride.DeclarationSite</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83546"><code>KT-83546</code></a>
Kotlin analysis reach ClsCustomNavigationPolicy</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84259"><code>KT-84259</code></a>
Move CommonDefaultImportsProvider to the frontend independent
module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82945"><code>KT-82945</code></a>
Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected
FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71135"><code>KT-71135</code></a>
AA: exception from sealed inheritors checker when
<code>analyzeCopy</code></li>
</ul>
<h3>Analysis API. Infrastructure</h3>
<h4>Fixes</h4>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83905"><code>KT-83905</code></a>
Analysis API: Improve UX with test data</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84913"><code>KT-84913</code></a>
Extract compiler classes used by the PSI & Analysis API to a
separate module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-64986"><code>KT-64986</code></a>
Analysis API: Implement Analysis API tests for different KMP
Platforms</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84776"><code>KT-84776</code></a>
The test data manager misses the redundancy check in the update
mode</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84962"><code>KT-84962</code></a>
The test data manager misses -ea flag</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84388"><code>KT-84388</code></a>
Preserve the EOF status in the test data manager to avoid extra
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84362"><code>KT-84362</code></a>
Analysis API tests produce many warnings due to "not yet loaded
registry"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84279"><code>KT-84279</code></a>
Test Data Manager fails on a clean build</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83913"><code>KT-83913</code></a>
Exclude compiler-based Analysis API tests from Git tracking</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-80379"><code>KT-80379</code></a>
Extract per-module test generators for AA tests</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84120"><code>KT-84120</code></a>
Move CLI modules out of kotlin-compiler-fe10-for-ide</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83200"><code>KT-83200</code></a>
Track external dependencies of the Analysis API modules</li>
</ul>
<h3>Analysis API. Light Classes</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82434"><code>KT-82434</code></a>
Light classes should prefer enum entries to properties</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84200"><code>KT-84200</code></a>
SLC: return type is not boxed for delegated methods with generic
original method</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-72451"><code>KT-72451</code></a>
"CCE: class PsiPrimitiveType cannot be cast to class
PsiClassType" with same-named enum class and typealias</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md">org.jetbrains.kotlin.plugin.serialization's
changelog</a>.</em></p>
<blockquote>
<h2>2.4.0</h2>
<h3>Analysis API</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83867"><code>KT-83867</code></a>
OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ
repo</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83723"><code>KT-83723</code></a>
[Analysis API] Enable experimental KDoc resolver by default</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83388"><code>KT-83388</code></a>
Analysis API: properly support KMP in KotlinPackageProvider</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-65683"><code>KT-65683</code></a>
Analysis API: Dangling file session creation causes a
<code>computeIfAbsent</code> contract violation</li>
</ul>
<h3>Analysis API. Code Compilation</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-78946"><code>KT-78946</code></a>
Evaluation of variable with local class in type parameter leads to
InventNamesForLocalClasses exception</li>
</ul>
<h3>Analysis API. FIR</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-68260"><code>KT-68260</code></a>
K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION
with text <code>::lam1</code>, unexpected element of type: no element
found” with illegal callable reference call</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-70896"><code>KT-70896</code></a>
AA: False positive deprecation warning with override of built-in method
in JDK mapped class</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84711"><code>KT-84711</code></a>
K2 IDE sometimes loses FIR plugin-generated declarations after file
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84625"><code>KT-84625</code></a>
Analysis API: collectDesignationPath fails for nested classes inside
plugin-generated top-level classes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84596"><code>KT-84596</code></a>
Improve K2 Jooq completion performance</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84525"><code>KT-84525</code></a>
KaValueParameterSymbol#getHasSynthesizedName returns false for
FirDeclarationOrigin.SubstitutionOverride.DeclarationSite</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83546"><code>KT-83546</code></a>
Kotlin analysis reach ClsCustomNavigationPolicy</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84259"><code>KT-84259</code></a>
Move CommonDefaultImportsProvider to the frontend independent
module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82945"><code>KT-82945</code></a>
Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected
FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71135"><code>KT-71135</code></a>
AA: exception from sealed inheritors checker when
<code>analyzeCopy</code></li>
</ul>
<h3>Analysis API. Infrastructure</h3>
<h4>Fixes</h4>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83905"><code>KT-83905</code></a>
Analysis API: Improve UX with test data</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84913"><code>KT-84913</code></a>
Extract compiler classes used by the PSI & Analysis API to a
separate module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-64986"><code>KT-64986</code></a>
Analysis API: Implement Analysis API tests for different KMP
Platforms</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84776"><code>KT-84776</code></a>
The test data manager misses the redundancy check in the update
mode</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84962"><code>KT-84962</code></a>
The test data manager misses -ea flag</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84388"><code>KT-84388</code></a>
Preserve the EOF status in the test data manager to avoid extra
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84362"><code>KT-84362</code></a>
Analysis API tests produce many warnings due to "not yet loaded
registry"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84279"><code>KT-84279</code></a>
Test Data Manager fails on a clean build</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83913"><code>KT-83913</code></a>
Exclude compiler-based Analysis API tests from Git tracking</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-80379"><code>KT-80379</code></a>
Extract per-module test generators for AA tests</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84120"><code>KT-84120</code></a>
Move CLI modules out of kotlin-compiler-fe10-for-ide</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83200"><code>KT-83200</code></a>
Track external dependencies of the Analysis API modules</li>
</ul>
<h3>Analysis API. Light Classes</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82434"><code>KT-82434</code></a>
Light classes should prefer enum entries to properties</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84200"><code>KT-84200</code></a>
SLC: return type is not boxed for delegated methods with generic
original method</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-72451"><code>KT-72451</code></a>
"CCE: class PsiPrimitiveType cannot be cast to class
PsiClassType" with same-named enum class and typealias</li>
</ul>
<h3>Analysis API. PSI</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="add726ca8c"><code>add726c</code></a>
Add ChangeLog for 2.4.0-RC2</li>
<li><a
href="69a4a81ef2"><code>69a4a81</code></a>
[Wasm] Add binaryen per-file arguments</li>
<li><a
href="8907c635d4"><code>8907c63</code></a>
[KGP] Suppress duplicate compiler warning output when --warning-mode=all
is a...</li>
<li><a
href="f9bef128ea"><code>f9bef12</code></a>
[KGP] Add failing test for duplicate compiler warning output via
Problems API</li>
<li><a
href="7fe49c227a"><code>7fe49c2</code></a>
KT-86268: Use 2.4.0 toolchain for abiValidation with older CVs</li>
<li><a
href="13d25e2c58"><code>13d25e2</code></a>
KT-86268: Regression test added</li>
<li><a
href="f7d1a76541"><code>f7d1a76</code></a>
[JKlib] Fix JAR deserializer configuration.</li>
<li><a
href="5cec663aff"><code>5cec663</code></a>
[JKlib] Wire up JvmBuiltInClassDescriptorFactory</li>
<li><a
href="ef146114de"><code>ef14611</code></a>
Make the default stability of non-final classes <code>Unknown</code>
instead of <code>Stable</code></li>
<li><a
href="d76473afd2"><code>d76473a</code></a>
[Gradle] Fix GeneralNativeIT.shouldAllowToOverrideDownloadUrl test
failures</li>
<li>Additional commits viewable in <a
href="https://github.com/JetBrains/kotlin/compare/v2.3.21...v2.4.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [org.jetbrains.kotlin.jvm](https://github.com/JetBrains/kotlin)
from 2.3.21 to 2.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/releases">org.jetbrains.kotlin.jvm's
releases</a>.</em></p>
<blockquote>
<h2>Kotlin 2.4.0</h2>
<h2>Changelog</h2>
<h3>Analysis API</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83867"><code>KT-83867</code></a>
OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ
repo</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83723"><code>KT-83723</code></a>
[Analysis API] Enable experimental KDoc resolver by default</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83388"><code>KT-83388</code></a>
Analysis API: properly support KMP in KotlinPackageProvider</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-65683"><code>KT-65683</code></a>
Analysis API: Dangling file session creation causes a
<code>computeIfAbsent</code> contract violation</li>
</ul>
<h3>Analysis API. Code Compilation</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-78946"><code>KT-78946</code></a>
Evaluation of variable with local class in type parameter leads to
InventNamesForLocalClasses exception</li>
</ul>
<h3>Analysis API. FIR</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-68260"><code>KT-68260</code></a>
K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION
with text <code>::lam1</code>, unexpected element of type: no element
found” with illegal callable reference call</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-70896"><code>KT-70896</code></a>
AA: False positive deprecation warning with override of built-in method
in JDK mapped class</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84711"><code>KT-84711</code></a>
K2 IDE sometimes loses FIR plugin-generated declarations after file
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84625"><code>KT-84625</code></a>
Analysis API: collectDesignationPath fails for nested classes inside
plugin-generated top-level classes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84596"><code>KT-84596</code></a>
Improve K2 Jooq completion performance</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84525"><code>KT-84525</code></a>
KaValueParameterSymbol#getHasSynthesizedName returns false for
FirDeclarationOrigin.SubstitutionOverride.DeclarationSite</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83546"><code>KT-83546</code></a>
Kotlin analysis reach ClsCustomNavigationPolicy</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84259"><code>KT-84259</code></a>
Move CommonDefaultImportsProvider to the frontend independent
module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82945"><code>KT-82945</code></a>
Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected
FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71135"><code>KT-71135</code></a>
AA: exception from sealed inheritors checker when
<code>analyzeCopy</code></li>
</ul>
<h3>Analysis API. Infrastructure</h3>
<h4>Fixes</h4>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83905"><code>KT-83905</code></a>
Analysis API: Improve UX with test data</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84913"><code>KT-84913</code></a>
Extract compiler classes used by the PSI & Analysis API to a
separate module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-64986"><code>KT-64986</code></a>
Analysis API: Implement Analysis API tests for different KMP
Platforms</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84776"><code>KT-84776</code></a>
The test data manager misses the redundancy check in the update
mode</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84962"><code>KT-84962</code></a>
The test data manager misses -ea flag</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84388"><code>KT-84388</code></a>
Preserve the EOF status in the test data manager to avoid extra
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84362"><code>KT-84362</code></a>
Analysis API tests produce many warnings due to "not yet loaded
registry"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84279"><code>KT-84279</code></a>
Test Data Manager fails on a clean build</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83913"><code>KT-83913</code></a>
Exclude compiler-based Analysis API tests from Git tracking</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-80379"><code>KT-80379</code></a>
Extract per-module test generators for AA tests</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84120"><code>KT-84120</code></a>
Move CLI modules out of kotlin-compiler-fe10-for-ide</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83200"><code>KT-83200</code></a>
Track external dependencies of the Analysis API modules</li>
</ul>
<h3>Analysis API. Light Classes</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82434"><code>KT-82434</code></a>
Light classes should prefer enum entries to properties</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84200"><code>KT-84200</code></a>
SLC: return type is not boxed for delegated methods with generic
original method</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-72451"><code>KT-72451</code></a>
"CCE: class PsiPrimitiveType cannot be cast to class
PsiClassType" with same-named enum class and typealias</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md">org.jetbrains.kotlin.jvm's
changelog</a>.</em></p>
<blockquote>
<h2>2.4.0</h2>
<h3>Analysis API</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83867"><code>KT-83867</code></a>
OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ
repo</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83723"><code>KT-83723</code></a>
[Analysis API] Enable experimental KDoc resolver by default</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83388"><code>KT-83388</code></a>
Analysis API: properly support KMP in KotlinPackageProvider</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-65683"><code>KT-65683</code></a>
Analysis API: Dangling file session creation causes a
<code>computeIfAbsent</code> contract violation</li>
</ul>
<h3>Analysis API. Code Compilation</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-78946"><code>KT-78946</code></a>
Evaluation of variable with local class in type parameter leads to
InventNamesForLocalClasses exception</li>
</ul>
<h3>Analysis API. FIR</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-68260"><code>KT-68260</code></a>
K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION
with text <code>::lam1</code>, unexpected element of type: no element
found” with illegal callable reference call</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-70896"><code>KT-70896</code></a>
AA: False positive deprecation warning with override of built-in method
in JDK mapped class</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84711"><code>KT-84711</code></a>
K2 IDE sometimes loses FIR plugin-generated declarations after file
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84625"><code>KT-84625</code></a>
Analysis API: collectDesignationPath fails for nested classes inside
plugin-generated top-level classes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84596"><code>KT-84596</code></a>
Improve K2 Jooq completion performance</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84525"><code>KT-84525</code></a>
KaValueParameterSymbol#getHasSynthesizedName returns false for
FirDeclarationOrigin.SubstitutionOverride.DeclarationSite</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83546"><code>KT-83546</code></a>
Kotlin analysis reach ClsCustomNavigationPolicy</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84259"><code>KT-84259</code></a>
Move CommonDefaultImportsProvider to the frontend independent
module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82945"><code>KT-82945</code></a>
Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected
FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71135"><code>KT-71135</code></a>
AA: exception from sealed inheritors checker when
<code>analyzeCopy</code></li>
</ul>
<h3>Analysis API. Infrastructure</h3>
<h4>Fixes</h4>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83905"><code>KT-83905</code></a>
Analysis API: Improve UX with test data</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84913"><code>KT-84913</code></a>
Extract compiler classes used by the PSI & Analysis API to a
separate module</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-64986"><code>KT-64986</code></a>
Analysis API: Implement Analysis API tests for different KMP
Platforms</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84776"><code>KT-84776</code></a>
The test data manager misses the redundancy check in the update
mode</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84962"><code>KT-84962</code></a>
The test data manager misses -ea flag</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84388"><code>KT-84388</code></a>
Preserve the EOF status in the test data manager to avoid extra
changes</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84362"><code>KT-84362</code></a>
Analysis API tests produce many warnings due to "not yet loaded
registry"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84279"><code>KT-84279</code></a>
Test Data Manager fails on a clean build</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83913"><code>KT-83913</code></a>
Exclude compiler-based Analysis API tests from Git tracking</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-80379"><code>KT-80379</code></a>
Extract per-module test generators for AA tests</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84120"><code>KT-84120</code></a>
Move CLI modules out of kotlin-compiler-fe10-for-ide</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-83200"><code>KT-83200</code></a>
Track external dependencies of the Analysis API modules</li>
</ul>
<h3>Analysis API. Light Classes</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82434"><code>KT-82434</code></a>
Light classes should prefer enum entries to properties</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84200"><code>KT-84200</code></a>
SLC: return type is not boxed for delegated methods with generic
original method</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-72451"><code>KT-72451</code></a>
"CCE: class PsiPrimitiveType cannot be cast to class
PsiClassType" with same-named enum class and typealias</li>
</ul>
<h3>Analysis API. PSI</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="add726ca8c"><code>add726c</code></a>
Add ChangeLog for 2.4.0-RC2</li>
<li><a
href="69a4a81ef2"><code>69a4a81</code></a>
[Wasm] Add binaryen per-file arguments</li>
<li><a
href="8907c635d4"><code>8907c63</code></a>
[KGP] Suppress duplicate compiler warning output when --warning-mode=all
is a...</li>
<li><a
href="f9bef128ea"><code>f9bef12</code></a>
[KGP] Add failing test for duplicate compiler warning output via
Problems API</li>
<li><a
href="7fe49c227a"><code>7fe49c2</code></a>
KT-86268: Use 2.4.0 toolchain for abiValidation with older CVs</li>
<li><a
href="13d25e2c58"><code>13d25e2</code></a>
KT-86268: Regression test added</li>
<li><a
href="f7d1a76541"><code>f7d1a76</code></a>
[JKlib] Fix JAR deserializer configuration.</li>
<li><a
href="5cec663aff"><code>5cec663</code></a>
[JKlib] Wire up JvmBuiltInClassDescriptorFactory</li>
<li><a
href="ef146114de"><code>ef14611</code></a>
Make the default stability of non-final classes <code>Unknown</code>
instead of <code>Stable</code></li>
<li><a
href="d76473afd2"><code>d76473a</code></a>
[Gradle] Fix GeneralNativeIT.shouldAllowToOverrideDownloadUrl test
failures</li>
<li>Additional commits viewable in <a
href="https://github.com/JetBrains/kotlin/compare/v2.3.21...v2.4.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
finished SEP-1686
closes#421
## Breaking Changes
none
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Caps the size of incoming HTTP POST bodies in both server transports so
an oversized request can no longer exhaust server memory
## How Has This Been Tested?
new tests
## Breaking Changes
binary incompatible for SseServerTransport constuctors
## Types of changes
- [x] Bug fix (non-breaking change which fixes a
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP Documentation](https:
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Summary
Fixes `StdioClientTransport.close()` so shutdown does not hang when the
stdin read loop is blocked waiting for input.
## Root Cause / Context
`StdioClientTransport.closeResources()` stopped the transport coroutine
scope and then waited for the scope job to finish. On the JVM, a
`Source.readAtMostTo()` call backed by a blocking Java stream does not
necessarily return when the coroutine is cancelled. If the read loop
stayed blocked, `close()` could wait indefinitely.
## Changes
- Close the stdin source during stdio client shutdown before waiting for
transport coroutines to finish.
- Also close the optional stderr source during shutdown.
- Keep source-close failures non-fatal and log them at debug level.
- Add a JVM regression test with a `RawSource` that blocks in
`readAtMostTo()` until `close()` is called.
- Assert the close path completes, emits `onClose`, and does not invoke
`onError`.
## Scope / Risk
This is limited to `StdioClientTransport` shutdown behavior. It does not
change the public API or server transports. The regression coverage is
JVM-focused because the reported hang is caused by a blocking Java
stream read.
## Verification
```bash
./gradlew :integration-test:jvmTest --tests 'io.modelcontextprotocol.kotlin.sdk.client.StdioClientTransportTest'
./gradlew :kotlin-sdk-client:jvmTest
./gradlew :kotlin-sdk-client:ktlintCheck :integration-test:ktlintCheck :kotlin-sdk-client:detekt :integration-test:detekt :kotlin-sdk-client:apiCheck
```
Closes#514
Gate `completion/complete` on the server's `completions` capability
instead of `prompts`.
closes#845
## Motivation and Context
A server that declares `completions` but not `prompts` is currently
rejected for completion. Details in #845.
## How Has This Been Tested?
New `ClientAssertCapabilityTest` cases; they fail on `main` and pass
with this change. `apiCheck` / `ktlintCheck` / `detekt` pass.
## Breaking Changes
None.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Co-authored-by: Pavel Gorgulov <devcrocod@gmail.com>
Default the `Origin` allowlist to localhost when
`DnsRebindingProtection` relies on the localhost host defaults, so a
request with a valid `Host` but a hostile (or `null`) `Origin` is no
longer accepted.
## How Has This Been Tested?
unit tests
## Breaking Changes
Behavioral change only
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Bumps
[ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from
1.5.34 to 1.5.37.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.37</h2>
<p><strong>2026-06-26 Release of logback version 1.5.37</strong></p>
<p>• Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an <a
href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online
migration service</a> or the <!-- raw HTML omitted --> element
introduced in version 1.5.20. See the <a
href="https://logback.qos.ch/manual/configuration.html#conditional">relevant
documentation</a> for more details.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.36</h2>
<p><strong>2026-06-25 Release of logback version 1.5.36</strong></p>
<p>• The 'condition' attribute in <code><if></code> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by "yulate" (<a
href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and
registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.35</h2>
<p><strong>026-06-23 Release of logback version 1.5.35</strong></p>
<p>• The 'condition' attribute in <code><if></code> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (<a
href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.</p>
<p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
<code>ContextInitializer</code> now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.</p>
<p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
<code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code>
will need an alternative approach for console charset detection.</p>
<p>• The logback-examples module is now included in artifacts published
to Maven Central.</p>
<p>• <code>JoranConfigurator.makeAnotherInstance()</code> and
<code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code>
are now protected, allowing derived configurators to override these
methods.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c1df7f522e"><code>c1df7f5</code></a>
prepare release 1.5.37</li>
<li><a
href="a189967457"><code>a189967</code></a>
remove conditional based on janino</li>
<li><a
href="aaa905292d"><code>aaa9052</code></a>
start work on 1.5.37-SNAPSHOT</li>
<li><a
href="9b94c37562"><code>9b94c37</code></a>
prepare release 1.5.36</li>
<li><a
href="e6a8280ba2"><code>e6a8280</code></a>
prevent attacks using disallowed references</li>
<li><a
href="24c4b63f60"><code>24c4b63</code></a>
start work on 1.5.36-SNAPSHOT</li>
<li><a
href="08bd1598d5"><code>08bd159</code></a>
preapre release 1.5.35</li>
<li><a
href="37d256b825"><code>37d256b</code></a>
indentation changes only</li>
<li><a
href="d3d73078af"><code>d3d7307</code></a>
minor comment</li>
<li><a
href="fa0411a939"><code>fa0411a</code></a>
radomize file location</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gradle-plugins group with 1 update in the / directory:
[com.vanniktech:gradle-maven-publish-plugin](https://github.com/vanniktech/gradle-maven-publish-plugin).
Updates `com.vanniktech:gradle-maven-publish-plugin` from 0.36.0 to
0.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/releases">com.vanniktech:gradle-maven-publish-plugin's
releases</a>.</em></p>
<blockquote>
<h2>0.37.0</h2>
<ul>
<li>When publishing to Maven Central, redundant checksum files are now
excluded by default: checksums of <code>.asc</code>
signature files (<a
href="https://redirect.github.com/gradle/gradle/issues/20232">gradle/gradle#20232</a>)
and the <code>sha256</code>/<code>sha512</code>
checksums, which are never read by Gradle or Maven Central. The
published checksums can be configured through
<code>checksums(...)</code> in the DSL or the
<code>mavenCentralChecksums</code> Gradle property (default
<code>md5,sha1</code>). Signature checksum
exclusion can be controlled through
<code>excludeSignatureChecksums()</code> or the
<code>mavenCentralExcludeSignatureChecksums</code>
Gradle property.</li>
<li>Maven Central deployment id is being logged after upload.</li>
</ul>
<h4>Minimum supported versions</h4>
<ul>
<li>JDK 17</li>
<li>Gradle 9.0.0</li>
<li>Android Gradle Plugin 8.13.0</li>
<li>Kotlin Gradle Plugin 2.2.0</li>
</ul>
<h4>Compatibility tested up to</h4>
<ul>
<li>JDK 26</li>
<li>Gradle 9.6.0</li>
<li>Gradle 9.7.0-milestone-1</li>
<li>Android Gradle Plugin 9.2.1</li>
<li>Android Gradle Plugin 9.3.0-rc01</li>
<li>Android Gradle Plugin 9.4.0-alpha01</li>
<li>Kotlin Gradle Plugin 2.4.0</li>
</ul>
<h2>0.37.0-rc1</h2>
<ul>
<li>When publishing to Maven Central, redundant checksum files are now
excluded by default: checksums of <code>.asc</code>
signature files (<a
href="https://redirect.github.com/gradle/gradle/issues/20232">gradle/gradle#20232</a>)
and the <code>sha256</code>/<code>sha512</code>
checksums, which are never read by Gradle or Maven Central. The
published checksums can be configured through
<code>checksums(...)</code> in the DSL or the
<code>mavenCentralChecksums</code> Gradle property (default
<code>md5,sha1</code>). Signature checksum
exclusion can be controlled through
<code>excludeSignatureChecksums()</code> or the
<code>mavenCentralExcludeSignatureChecksums</code>
Gradle property.</li>
<li>Maven Central deployment id is being logged after upload.</li>
</ul>
<h4>Minimum supported versions</h4>
<ul>
<li>JDK 17</li>
<li>Gradle 9.0.0</li>
<li>Android Gradle Plugin 8.13.0</li>
<li>Kotlin Gradle Plugin 2.2.0</li>
</ul>
<h4>Compatibility tested up to</h4>
<ul>
<li>JDK 26</li>
<li>Gradle 9.6.0</li>
<li>Gradle 9.7.0-milestone-1</li>
<li>Android Gradle Plugin 9.2.1</li>
<li>Android Gradle Plugin 9.3.0-rc01</li>
<li>Android Gradle Plugin 9.4.0-alpha01</li>
<li>Kotlin Gradle Plugin 2.4.0</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/blob/main/CHANGELOG.md">com.vanniktech:gradle-maven-publish-plugin's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/releases/tag/0.37.0">0.37.0</a>
<em>(2026-06-21)</em></h2>
<ul>
<li>When publishing to Maven Central, redundant checksum files are now
excluded by default: checksums of <code>.asc</code>
signature files (<a
href="https://redirect.github.com/gradle/gradle/issues/20232">gradle/gradle#20232</a>)
and the <code>sha256</code>/<code>sha512</code>
checksums, which are never read by Gradle or Maven Central. The
published checksums can be configured through
<code>checksums(...)</code> in the DSL or the
<code>mavenCentralChecksums</code> Gradle property (default
<code>md5,sha1</code>). Signature checksum
exclusion can be controlled through
<code>excludeSignatureChecksums()</code> or the
<code>mavenCentralExcludeSignatureChecksums</code>
Gradle property.</li>
<li>Maven Central deployment id is being logged after upload.</li>
</ul>
<h4>Minimum supported versions</h4>
<ul>
<li>JDK 17</li>
<li>Gradle 9.0.0</li>
<li>Android Gradle Plugin 8.13.0</li>
<li>Kotlin Gradle Plugin 2.2.0</li>
</ul>
<h4>Compatibility tested up to</h4>
<ul>
<li>JDK 26</li>
<li>Gradle 9.6.0</li>
<li>Gradle 9.7.0-milestone-1</li>
<li>Android Gradle Plugin 9.2.1</li>
<li>Android Gradle Plugin 9.3.0-rc01</li>
<li>Android Gradle Plugin 9.4.0-alpha01</li>
<li>Kotlin Gradle Plugin 2.4.0</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7017e3d3d1"><code>7017e3d</code></a>
enable feature preview (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1381">#1381</a>)</li>
<li><a
href="05f6b6ece1"><code>05f6b6e</code></a>
use 0.37.0-rc1 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1380">#1380</a>)</li>
<li><a
href="0167c9cc7b"><code>0167c9c</code></a>
Changelog for 0.37.0 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1379">#1379</a>)</li>
<li><a
href="b652eb3302"><code>b652eb3</code></a>
Update dependency java to v26 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1353">#1353</a>)</li>
<li><a
href="a9f70b326d"><code>a9f70b3</code></a>
Update dependency com.freeletics.gradle:scripts-formatting-jvm to
v0.37.0 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1">#1</a>...</li>
<li><a
href="541cf8fd79"><code>541cf8f</code></a>
Log deployment id and publishing type after Central Portal upload (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1354">#1354</a>)</li>
<li><a
href="d4873e5589"><code>d4873e5</code></a>
Update slf4j monorepo to v2 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1365">#1365</a>)</li>
<li><a
href="42baf9d49f"><code>42baf9d</code></a>
Update android.gradle (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1335">#1335</a>)</li>
<li><a
href="2de1978ae4"><code>2de1978</code></a>
Update Gradle (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1362">#1362</a>)</li>
<li><a
href="6f03e46264"><code>6f03e46</code></a>
Update kotlin monorepo to v2.4.0 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1352">#1352</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/compare/0.36.0...0.37.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.27.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.27</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>hono/jsx does not isolate context per request</h3>
<p>Affects: <code>hono/jsx</code>, <code>hono/jsx-renderer</code>.
During SSR, context was stored process-wide instead of per request, so
<code>useContext()</code>/<code>useRequestContext()</code> read after an
<code>await</code> in an async component could return another concurrent
request's value — leading to cross-request data disclosure or
authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj</p>
<h3>Server-Side XSS via JSX escaping bypass in cx()</h3>
<p>Affects: <code>hono/css</code>. <code>cx()</code> marked its composed
class name as already-escaped without escaping the input, so untrusted
input passed as a class name could break out of the JSX
<code>class</code> attribute during SSR and inject markup (XSS).
GHSA-w62v-xxxg-mg59</p>
<h3>API Gateway v1 adapter can drop a repeated request header value</h3>
<p>Affects: <code>hono/aws-lambda</code>. The API Gateway v1 (and VPC
Lattice) adapter de-duplicated repeated header values by substring
instead of exact match, dropping a value that is a substring of another
(e.g. <code>203.0.113.1</code> dropped when <code>203.0.113.10</code> is
present) — affecting logic such as <code>X-Forwarded-For</code>-based IP
restriction. GHSA-xgm2-5f3f-mvvc</p>
<hr />
<p>Users of <code>hono/jsx</code>/<code>hono/jsx-renderer</code>,
<code>hono/css</code> (<code>cx()</code>), or the
<code>hono/aws-lambda</code> API Gateway v1 / VPC Lattice adapters are
encouraged to upgrade.</p>
<h2>v4.12.26</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5013">honojs/hono#5013</a></li>
<li>ci: publish to npm from CI with OIDC trusted publishing by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5028">honojs/hono#5028</a></li>
<li>chore: remove unused devcontainer and gitpod configs by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5029">honojs/hono#5029</a></li>
<li>chore: replace arg and glob with Bun native APIs in build script by
<a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5030">honojs/hono#5030</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26">https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when
<code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting
the request <code>Origin</code> and sending
<code>Access-Control-Allow-Credentials: true</code> when
<code>credentials: true</code> is set without an explicit
<code>origin</code>, where any site a logged-in user visited could make
credentialed cross-origin requests and read responses from
cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating
<code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda
(<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the
request being built with the client-declared <code>Content-Length</code>
while the body is delivered fully buffered, where a client could declare
a small <code>Content-Length</code> with a much larger body and slip
past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded
backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno
adapters). Fixes the path guard allowing a lone backslash, where an
encoded backslash (<code>%5C</code>) decoded to <code>\</code> was
treated as a separator by the Windows path resolver, letting a single
URL segment escape into a middleware-guarded subtree.
GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers
into one value, dropping cookies on ALB single-header and Lattice</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="97c6fe1f12"><code>97c6fe1</code></a>
4.12.27</li>
<li><a
href="aa921770d0"><code>aa92177</code></a>
Merge commit from fork</li>
<li><a
href="cd3f6f7194"><code>cd3f6f7</code></a>
Merge commit from fork</li>
<li><a
href="d4853a8f27"><code>d4853a8</code></a>
fix(jsx): make merged context-isolation tests pass tsc type check (<a
href="https://redirect.github.com/honojs/hono/issues/5037">#5037</a>)</li>
<li><a
href="6735fea78d"><code>6735fea</code></a>
fix(jsx): cast awaitedFallback through unknown to fix Deno type check
(<a
href="https://redirect.github.com/honojs/hono/issues/5036">#5036</a>)</li>
<li><a
href="fab3b13639"><code>fab3b13</code></a>
Merge commit from fork</li>
<li><a
href="9f0dadf141"><code>9f0dadf</code></a>
ci: use npm Staged publishing (<a
href="https://redirect.github.com/honojs/hono/issues/5035">#5035</a>)</li>
<li><a
href="27b7992f82"><code>27b7992</code></a>
4.12.26</li>
<li><a
href="d29982cc40"><code>d29982c</code></a>
chore: replace arg and glob with Bun native APIs in build script</li>
<li><a
href="16215d5f50"><code>16215d5</code></a>
chore: remove unused devcontainer and gitpod configs (<a
href="https://redirect.github.com/honojs/hono/issues/5029">#5029</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.27">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for hono since your current version.</p>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
closes#410
## How Has This Been Tested?
integration and unit tests
## Breaking Changes
none
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Bound the size of a single inline SSE event parsed from a POST response
in `StreamableHttpClientTransport`, so a non-conforming or unbounded
server response cannot grow the client's buffer without limit.
## How Has This Been Tested?
New unit tests
## Breaking Changes
none
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Summary
- reject empty sampling content in SamplingMessage and
CreateMessageResult constructors
- clarify sampling validation docs and emit an explicit error when
tool_use is not followed by tool_result
- return sampled text from the conformance test_sampling tool instead of
content object strings
Fixes#730
## Testing
- ./gradlew
-Dorg.gradle.java.installations.paths="/Users/ubl/Documents/New
project/oss-contributions/.jdks/jdk-21.0.11+10/Contents/Home"
:kotlin-sdk-core:jvmTest :kotlin-sdk-server:jvmTest
:conformance-test:compileKotlin
Co-authored-by: Pavel Gorgulov <devcrocod@gmail.com>
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.0 to 0.28.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera"><code>@dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99"><code>@sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera"><code>@dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99"><code>@sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bb9db84c02"><code>bb9db84</code></a>
publish 0.28.1 to npm</li>
<li><a
href="9ff053e53b"><code>9ff053e</code></a>
security: add integrity checks to the Deno API</li>
<li><a
href="0a9bf2135b"><code>0a9bf21</code></a>
enforce non-negative size in gzip parser</li>
<li><a
href="e2a1a71320"><code>e2a1a71</code></a>
security: forbid <code>\\</code> in local dev server requests</li>
<li><a
href="83a2cbfc35"><code>83a2cbf</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>:
don't inline <code>using</code> declarations</li>
<li><a
href="308ad745d8"><code>308ad74</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>:
renaming of nested <code>var</code> declarations</li>
<li><a
href="f013f5f99a"><code>f013f5f</code></a>
fix some typos</li>
<li><a
href="aafd6e48b1"><code>aafd6e4</code></a>
chore: fix some minor issues in comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li>
<li><a
href="15300c30b5"><code>15300c3</code></a>
follow up: cjs evaluation fixes</li>
<li><a
href="1bda0c31d7"><code>1bda0c3</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>:
esm evaluation fixes</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.28.0...v0.28.1">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[io.modelcontextprotocol:kotlin-sdk-client](https://github.com/modelcontextprotocol/kotlin-sdk)
from 0.12.0 to 0.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-testing` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-testing's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.23.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.23</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(serve-static): normalize all backslashes in file paths, not just
the first in <a
href="https://redirect.github.com/honojs/hono/pull/4962">honojs/hono#4962</a></li>
<li>feat(context): export the Context class publicly by <a
href="https://github.com/BlankParticle"><code>@BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4543">honojs/hono#4543</a></li>
<li>docs(contribution): add AI Usage Policy by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4970">honojs/hono#4970</a></li>
<li>feat(compress): add contentTypeFilter option and
<code>COMPRESSIBLE_CONTENT_TYPE_REGEX</code> re-export by <a
href="https://github.com/na-trium-144"><code>@na-trium-144</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4961">honojs/hono#4961</a></li>
<li>fix(utils/ipaddr): do not compress a single 0 group to
<code>::</code> by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4971">honojs/hono#4971</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.22...v4.12.23">https://github.com/honojs/hono/compare/v4.12.22...v4.12.23</a></p>
<h2>v4.12.22</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update vitest to v4 and cleanups by <a
href="https://github.com/BlankParticle"><code>@BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4952">honojs/hono#4952</a></li>
<li>fix(mime): specify charset parameter per MIME type instead of
mechanical detection by <a
href="https://github.com/renatograsso10"><code>@renatograsso10</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4912">honojs/hono#4912</a></li>
<li>fix(compress): respect Accept-Encoding when encoding option is set
by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4951">honojs/hono#4951</a></li>
<li>fix(deno): echo negotiated WebSocket subprotocol in upgrade response
by <a href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4955">honojs/hono#4955</a></li>
<li>feat: add msgpack as a compressible content type by <a
href="https://github.com/na-trium-144"><code>@na-trium-144</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4957">honojs/hono#4957</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/renatograsso10"><code>@renatograsso10</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4912">honojs/hono#4912</a></li>
<li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4951">honojs/hono#4951</a></li>
<li><a
href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4955">honojs/hono#4955</a></li>
<li><a
href="https://github.com/na-trium-144"><code>@na-trium-144</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4957">honojs/hono#4957</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.21...v4.12.22">https://github.com/honojs/hono/compare/v4.12.21...v4.12.22</a></p>
<h2>v4.12.21</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>app.mount() strips mount prefix using undecoded path, causing
incorrect routing for percent-encoded paths</h3>
<p>Affects: <code>app.mount()</code>. Fixes prefix stripping using the
raw URL pathname instead of the decoded path, where percent-encoded
characters in the mount prefix or path could cause the prefix to be
removed at the wrong position, resulting in the sub-application
receiving an incorrect path. GHSA-2gcr-mfcq-wcc3</p>
<h3>IP Restriction bypasses static deny rules for non-canonical
IPv6</h3>
<p>Affects: <code>hono/ip-restriction</code>. Fixes IP address
comparison using string equality, where non-canonical IPv6
representations of a denied address — such as compressed forms or
hex-notation IPv4-mapped addresses — could bypass static deny rules.
GHSA-xrhx-7g5j-rcj5</p>
<h3>Cookie helper does not sanitize sameSite and priority, allowing
Set-Cookie injection</h3>
<p>Affects: <code>hono/cookie</code>. Fixes missing validation of
<code>sameSite</code> and <code>priority</code> options against
injection characters (<code>;</code>, <code>\r</code>, <code>\n</code>),
where user-controlled input passed to either option could inject
additional attributes into the Set-Cookie response header.
GHSA-3hrh-pfw6-9m5x</p>
<h3>JWT middleware accepts any Authorization scheme, not only
Bearer</h3>
<p>Affects: <code>hono/jwt</code>, <code>hono/jwk</code>. Fixes missing
scheme validation in the Authorization header, where any two-part header
value was accepted regardless of the scheme name, allowing non-Bearer
schemes to pass JWT authentication. GHSA-f577-qrjj-4474</p>
<hr />
<p>Users who use <code>app.mount()</code>,
<code>hono/ip-restriction</code>, <code>hono/cookie</code>, or
<code>hono/jwt</code>/<code>hono/jwk</code> are encouraged to upgrade to
this version.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="83bfb3bb4a"><code>83bfb3b</code></a>
4.12.23</li>
<li><a
href="bcd290a64c"><code>bcd290a</code></a>
fix(utils/ipaddr): do not compress a single 0 group to <code>::</code>
(<a
href="https://redirect.github.com/honojs/hono/issues/4971">#4971</a>)</li>
<li><a
href="c968177d9c"><code>c968177</code></a>
feat(compress): add contentTypeFilter option and
`COMPRESSIBLE_CONTENT_TYPE_R...</li>
<li><a
href="0265a5453a"><code>0265a54</code></a>
docs(contribution): add AI Usage Policy (<a
href="https://redirect.github.com/honojs/hono/issues/4970">#4970</a>)</li>
<li><a
href="c84c5d2d46"><code>c84c5d2</code></a>
feat(context): export the Context class publicly (<a
href="https://redirect.github.com/honojs/hono/issues/4543">#4543</a>)</li>
<li><a
href="82dad6297c"><code>82dad62</code></a>
fix(serve-static): normalize all backslashes in file paths, not just the
firs...</li>
<li><a
href="2f01b774b1"><code>2f01b77</code></a>
4.12.22</li>
<li><a
href="6bc0dff277"><code>6bc0dff</code></a>
feat: add msgpack as a compressible content type (<a
href="https://redirect.github.com/honojs/hono/issues/4957">#4957</a>)</li>
<li><a
href="7e0555d14c"><code>7e0555d</code></a>
fix(deno): echo negotiated WebSocket subprotocol in upgrade response (<a
href="https://redirect.github.com/honojs/hono/issues/4955">#4955</a>)</li>
<li><a
href="f0ed246591"><code>f0ed246</code></a>
fix(compress): respect Accept-Encoding when encoding option is set (<a
href="https://redirect.github.com/honojs/hono/issues/4951">#4951</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.18...v4.12.23">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from
1.5.32 to 1.5.34.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java "21" 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan="true" attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code><conversionRule></code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the "java.lang" and
"java.util" packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
"TLSv1.2". This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as "&" as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e62272ac15"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="1e9e926db1"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="2de5cbe90b"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="0e9b9278b5"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="f7a0654c2b"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="249b81f375"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="1c3b26a839"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="124e8b49b5"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="d8fd6f25c7"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="95edbeb8db"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the other-dependencies group with 2 updates in the
/samples/kotlin-mcp-client directory:
[com.anthropic:anthropic-java](https://github.com/anthropics/anthropic-sdk-java)
and [com.gradleup.shadow](https://github.com/GradleUp/shadow).
Bumps the other-dependencies group with 1 update in the
/samples/kotlin-mcp-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow).
Bumps the other-dependencies group with 2 updates in the
/samples/kotlinlang-mcp-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow) and
[ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the other-dependencies group with 1 update in the
/samples/simple-streamable-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow).
Bumps the other-dependencies group with 2 updates in the
/samples/weather-stdio-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow) and
[io.github.oshai:kotlin-logging-jvm](https://github.com/oshai/kotlin-logging).
Updates `com.anthropic:anthropic-java` from 2.34.0 to 2.35.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-java/releases">com.anthropic:anthropic-java's
releases</a>.</em></p>
<blockquote>
<h2>v2.35.0</h2>
<h2>2.35.0 (2026-05-28)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.1...v2.35.0">v2.34.1...v2.35.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> Add support for claude-opus-4-8,
mid-conversation system blocks, and usage.output_tokens_details (<a
href="3e4621e676">3e4621e</a>)</li>
</ul>
<h2>v2.34.1</h2>
<h2>2.34.1 (2026-05-27)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.0...v2.34.1">v2.34.0...v2.34.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>structured-outputs:</strong> support all nullability
annotations (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1254">#1254</a>)
(<a
href="95e4391443">95e4391</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>replace literal newlines (<a
href="c5573d98ef">c5573d9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-java/blob/main/CHANGELOG.md">com.anthropic:anthropic-java's
changelog</a>.</em></p>
<blockquote>
<h2>2.35.0 (2026-05-28)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.1...v2.35.0">v2.34.1...v2.35.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> Add support for claude-opus-4-8,
mid-conversation system blocks, and usage.output_tokens_details (<a
href="3e4621e676">3e4621e</a>)</li>
</ul>
<h2>2.34.1 (2026-05-27)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.0...v2.34.1">v2.34.0...v2.34.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>structured-outputs:</strong> support all nullability
annotations (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1254">#1254</a>)
(<a
href="95e4391443">95e4391</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>replace literal newlines (<a
href="c5573d98ef">c5573d9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="65d26cc371"><code>65d26cc</code></a>
release: 2.35.0</li>
<li><a
href="f901010691"><code>f901010</code></a>
feat(api): Add support for claude-opus-4-8, mid-conversation system
blocks, a...</li>
<li><a
href="bc1bdd9a38"><code>bc1bdd9</code></a>
release: 2.34.1</li>
<li><a
href="f27e209ac9"><code>f27e209</code></a>
fix(structured-outputs): support all nullability annotations (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1254">#1254</a>)</li>
<li><a
href="62ef906b3c"><code>62ef906</code></a>
docs: replace literal newlines</li>
<li><a
href="dc19d08217"><code>dc19d08</code></a>
ci: run breaking change detection on every branch (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1224">#1224</a>)</li>
<li><a
href="1382286f46"><code>1382286</code></a>
codegen metadata</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.0...v2.35.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java "21" 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan="true" attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code><conversionRule></code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the "java.lang" and
"java.util" packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
"TLSv1.2". This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as "&" as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e62272ac15"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="1e9e926db1"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="2de5cbe90b"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="0e9b9278b5"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="f7a0654c2b"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="249b81f375"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="1c3b26a839"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="124e8b49b5"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="d8fd6f25c7"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="95edbeb8db"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.github.oshai:kotlin-logging-jvm` from 8.0.03 to 8.0.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oshai/kotlin-logging/releases">io.github.oshai:kotlin-logging-jvm's
releases</a>.</em></p>
<blockquote>
<h2>8.0.4</h2>
<p>Align to semver.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/oshai/kotlin-logging/compare/8.0.03...8.0.4">https://github.com/oshai/kotlin-logging/compare/8.0.03...8.0.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0aaa57ccef"><code>0aaa57c</code></a>
bump to semver 8.0.5</li>
<li><a
href="bf60363f6c"><code>bf60363</code></a>
change to semver 8.0.4</li>
<li>See full diff in <a
href="https://github.com/oshai/kotlin-logging/compare/8.0.03...8.0.4">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
fixes#573fixes#574fixes#708
- Handlers ran on `Dispatchers.IO` → now `Dispatchers.Default`,
configurable via `handlerDispatcher`.
- Reader/writer dispatcher exposed as `ioDispatcher` (default
`IODispatcher.limitedParallelism(2)`).
- Optional caller-supplied `CoroutineScope` so the pipeline isn't
detached from the caller's tree.
- `CancellationException` consistently rethrown across all pumps.
- Unbounded channels → bounded with graceful drain on close (in-flight
outbound flushed before `onClose`).
- Input `Source` now closed on natural EOF / reader error (was leaking
for non-`System.in` sources).
- Race between `start()` and `close()` fixed via 3-state CAS +
`setupComplete` barrier replacing `AtomicBoolean`.
## How Has This Been Tested?
unit and integration tests
## Breaking Changes
- Handlers default to `Dispatchers.Default` (was `Dispatchers.IO`).
Override with `handlerDispatcher = Dispatchers.IO` if your handlers
perform blocking I/O.
- `send()` suspends under back-pressure instead of buffering unbounded.
- `StdioServerTransport(input, output)` ctor is `@Deprecated` (WARNING)
in favor of `StdioServerTransport(input, output) { ... }`. Still
binary-compatible.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
dependabot[bot]
Pavel Gorgulov
King Star
Takuya Akamatsu
Mukunda Rao Katta