## Summary
- reject empty sampling content in SamplingMessage and
CreateMessageResult constructors
- clarify sampling validation docs and emit an explicit error when
tool_use is not followed by tool_result
- return sampled text from the conformance test_sampling tool instead of
content object strings
Fixes#730
## Testing
- ./gradlew
-Dorg.gradle.java.installations.paths="/Users/ubl/Documents/New
project/oss-contributions/.jdks/jdk-21.0.11+10/Contents/Home"
:kotlin-sdk-core:jvmTest :kotlin-sdk-server:jvmTest
:conformance-test:compileKotlin
Co-authored-by: Pavel Gorgulov <devcrocod@gmail.com>
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.0 to 0.28.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera"><code>@dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99"><code>@sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera"><code>@dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99"><code>@sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bb9db84c02"><code>bb9db84</code></a>
publish 0.28.1 to npm</li>
<li><a
href="9ff053e53b"><code>9ff053e</code></a>
security: add integrity checks to the Deno API</li>
<li><a
href="0a9bf2135b"><code>0a9bf21</code></a>
enforce non-negative size in gzip parser</li>
<li><a
href="e2a1a71320"><code>e2a1a71</code></a>
security: forbid <code>\\</code> in local dev server requests</li>
<li><a
href="83a2cbfc35"><code>83a2cbf</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>:
don't inline <code>using</code> declarations</li>
<li><a
href="308ad745d8"><code>308ad74</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>:
renaming of nested <code>var</code> declarations</li>
<li><a
href="f013f5f99a"><code>f013f5f</code></a>
fix some typos</li>
<li><a
href="aafd6e48b1"><code>aafd6e4</code></a>
chore: fix some minor issues in comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li>
<li><a
href="15300c30b5"><code>15300c3</code></a>
follow up: cjs evaluation fixes</li>
<li><a
href="1bda0c31d7"><code>1bda0c3</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>:
esm evaluation fixes</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.28.0...v0.28.1">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[io.modelcontextprotocol:kotlin-sdk-client](https://github.com/modelcontextprotocol/kotlin-sdk)
from 0.12.0 to 0.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `mcp-kotlin` from 0.12.0 to 0.13.0.
Updates `io.modelcontextprotocol:kotlin-sdk-server` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-server's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-client` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-client's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.modelcontextprotocol:kotlin-sdk-testing` from 0.12.0 to
0.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/releases">io.modelcontextprotocol:kotlin-sdk-testing's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Description</h2>
<p>Adds a <code>tasks</code> capability and a typed
<code>elicitation</code> capability, hardens transport lifecycle,
dispatchers, and back-pressure, and enables DNS rebinding protection by
default.</p>
<h3>Breaking Changes</h3>
<p><strong>Typed <code>elicitation</code> capability and new
<code>tasks</code> capability</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></p>
<p><code>ClientCapabilities.elicitation</code> is now a typed
<code>ClientCapabilities.Elicitation</code> (<code>form</code>,
<code>url</code>) instead of a raw <code>JsonObject?</code>, and both
<code>ClientCapabilities</code> and <code>ServerCapabilities</code>
gained a typed <code>tasks</code> capability. The constructors of both
types changed and are binary-incompatible; recompilation is
required.</p>
<p><strong>Transport handlers now run on
<code>Dispatchers.Default</code></strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></p>
<p>Handlers moved from <code>Dispatchers.IO</code> to
<code>Dispatchers.Default</code> (override via
<code>handlerDispatcher</code>), <code>send()</code> now suspends under
back-pressure instead of buffering unbounded, and the two-argument
<code>StdioServerTransport(input, output)</code> constructor is
deprecated in favor of the builder-lambda form. Also fixes a
<code>start()</code>/<code>close()</code> race, consistent
<code>CancellationException</code> propagation, and an
input-<code>Source</code> leak (closes <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/573">#573</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/574">#574</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/708">#708</a>).</p>
<p><strong>DNS rebinding protection enabled by default</strong> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></p>
<p><code>enableDnsRebindingProtection</code> now defaults to
<code>true</code> on
<code>mcpStreamableHttp</code>/<code>mcpStatelessStreamableHttp</code>,
and the <code>Route.mcp()</code> / <code>Application.mcp()</code>
overloads gained <code>enableDnsRebindingProtection</code>,
<code>allowedHosts</code>, and <code>allowedOrigins</code> parameters
(binary-incompatible on JVM). Only <code>localhost</code>,
<code>127.0.0.1</code>, and <code>[::1]</code> are allowed by default;
opt out with <code>enableDnsRebindingProtection = false</code>. The
<code>Configuration.enableDnsRebindingProtection</code>,
<code>.allowedHosts</code>, and <code>.allowedOrigins</code> properties
are deprecated in favor of the new <code>DnsRebindingProtection</code>
plugin.</p>
<h3>Features</h3>
<ul>
<li>Add a <code>tasks</code> capability (<code>list</code>,
<code>cancel</code>, and per-request augmentation for sampling and
elicitation) on <code>ClientCapabilities</code> and
<code>ServerCapabilities</code>, with assertions for
<code>tasks/*</code> and <code>notifications/tasks/status</code>
enforced by <code>Client</code> and <code>ServerSession</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/732">#732</a></li>
<li>Configurable <code>handlerDispatcher</code> and
<code>ioDispatcher</code>, plus an optional caller-supplied
<code>CoroutineScope</code>, on transports by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/778">#778</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fire <code>onClose</code> callbacks on
<code>SseClientTransport</code> when the SSE session ends — whether
closed gracefully or terminated by an error — matching the other client
transports by <a
href="https://github.com/jskjw157"><code>@jskjw157</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/738">#738</a></li>
</ul>
<h3>Security</h3>
<ul>
<li>Enable DNS rebinding protection by default across all HTTP
transports, including the SSE endpoints that previously had none (see
Breaking Changes for migration) by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/659">#659</a></li>
<li>Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new
<code>TooLongFrameException</code> instead of buffering unbounded when a
peer never sends a newline terminator by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="6e6f80512f">6e6f805</a></li>
</ul>
<h3>Maintenance</h3>
<ul>
<li>Remove the test-only <code>dev.mokksy:mokksy</code> dependency in
favor of <code>MockEngine</code> and <code>embeddedServer</code> by <a
href="https://github.com/devcrocod"><code>@devcrocod</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/754">#754</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Ktor to v3.4.3 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/785">#785</a></li>
<li>kotlinx.coroutines to v1.11.0 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/760">#760</a></li>
<li>kotlin-logging to v8.0.03 in <a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/752">#752</a>,
<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/pull/783">#783</a></li>
<li>24 further Dependabot updates across sample projects, TypeScript
conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple,
Gradle wrapper, anthropic-java)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b7eeeb1205"><code>b7eeeb1</code></a>
release: 0.13.0 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/796">#796</a>)</li>
<li><a
href="6e6f80512f"><code>6e6f805</code></a>
Merge commit from fork</li>
<li><a
href="0eb1822853"><code>0eb1822</code></a>
Update Ktor to version 3.4.3 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/785">#785</a>)</li>
<li><a
href="0adfb3bcdb"><code>0adfb3b</code></a>
fix!: harden lifecycle, dispatchers, back-pressure (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/778">#778</a>)</li>
<li><a
href="37ee423308"><code>37ee423</code></a>
chore(deps): bump the infrastructure group with 2 updates (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/783">#783</a>)</li>
<li><a
href="ff4b6232ba"><code>ff4b623</code></a>
chore(deps): bump the other-dependencies group across 3 directories with
3 up...</li>
<li><a
href="78066a9cf6"><code>78066a9</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li><a
href="1ff5f003b6"><code>1ff5f00</code></a>
chore(deps): bump qs from 6.14.2 to 6.15.2 in
/integration-test/src/jvmTest/t...</li>
<li><a
href="6d5bac1e67"><code>6d5bac1</code></a>
chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (<a
href="https://redirect.github.com/modelcontextprotocol/kotlin-sdk/issues/776">#776</a>)</li>
<li><a
href="c8545606bb"><code>c854560</code></a>
chore(deps): bump the all-dependencies group across 1 directory with 2
update...</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/kotlin-sdk/compare/0.12.0...0.13.0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.23.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.23</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(serve-static): normalize all backslashes in file paths, not just
the first in <a
href="https://redirect.github.com/honojs/hono/pull/4962">honojs/hono#4962</a></li>
<li>feat(context): export the Context class publicly by <a
href="https://github.com/BlankParticle"><code>@BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4543">honojs/hono#4543</a></li>
<li>docs(contribution): add AI Usage Policy by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4970">honojs/hono#4970</a></li>
<li>feat(compress): add contentTypeFilter option and
<code>COMPRESSIBLE_CONTENT_TYPE_REGEX</code> re-export by <a
href="https://github.com/na-trium-144"><code>@na-trium-144</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4961">honojs/hono#4961</a></li>
<li>fix(utils/ipaddr): do not compress a single 0 group to
<code>::</code> by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4971">honojs/hono#4971</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.22...v4.12.23">https://github.com/honojs/hono/compare/v4.12.22...v4.12.23</a></p>
<h2>v4.12.22</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update vitest to v4 and cleanups by <a
href="https://github.com/BlankParticle"><code>@BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4952">honojs/hono#4952</a></li>
<li>fix(mime): specify charset parameter per MIME type instead of
mechanical detection by <a
href="https://github.com/renatograsso10"><code>@renatograsso10</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4912">honojs/hono#4912</a></li>
<li>fix(compress): respect Accept-Encoding when encoding option is set
by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4951">honojs/hono#4951</a></li>
<li>fix(deno): echo negotiated WebSocket subprotocol in upgrade response
by <a href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4955">honojs/hono#4955</a></li>
<li>feat: add msgpack as a compressible content type by <a
href="https://github.com/na-trium-144"><code>@na-trium-144</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4957">honojs/hono#4957</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/renatograsso10"><code>@renatograsso10</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4912">honojs/hono#4912</a></li>
<li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4951">honojs/hono#4951</a></li>
<li><a
href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4955">honojs/hono#4955</a></li>
<li><a
href="https://github.com/na-trium-144"><code>@na-trium-144</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4957">honojs/hono#4957</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.21...v4.12.22">https://github.com/honojs/hono/compare/v4.12.21...v4.12.22</a></p>
<h2>v4.12.21</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>app.mount() strips mount prefix using undecoded path, causing
incorrect routing for percent-encoded paths</h3>
<p>Affects: <code>app.mount()</code>. Fixes prefix stripping using the
raw URL pathname instead of the decoded path, where percent-encoded
characters in the mount prefix or path could cause the prefix to be
removed at the wrong position, resulting in the sub-application
receiving an incorrect path. GHSA-2gcr-mfcq-wcc3</p>
<h3>IP Restriction bypasses static deny rules for non-canonical
IPv6</h3>
<p>Affects: <code>hono/ip-restriction</code>. Fixes IP address
comparison using string equality, where non-canonical IPv6
representations of a denied address — such as compressed forms or
hex-notation IPv4-mapped addresses — could bypass static deny rules.
GHSA-xrhx-7g5j-rcj5</p>
<h3>Cookie helper does not sanitize sameSite and priority, allowing
Set-Cookie injection</h3>
<p>Affects: <code>hono/cookie</code>. Fixes missing validation of
<code>sameSite</code> and <code>priority</code> options against
injection characters (<code>;</code>, <code>\r</code>, <code>\n</code>),
where user-controlled input passed to either option could inject
additional attributes into the Set-Cookie response header.
GHSA-3hrh-pfw6-9m5x</p>
<h3>JWT middleware accepts any Authorization scheme, not only
Bearer</h3>
<p>Affects: <code>hono/jwt</code>, <code>hono/jwk</code>. Fixes missing
scheme validation in the Authorization header, where any two-part header
value was accepted regardless of the scheme name, allowing non-Bearer
schemes to pass JWT authentication. GHSA-f577-qrjj-4474</p>
<hr />
<p>Users who use <code>app.mount()</code>,
<code>hono/ip-restriction</code>, <code>hono/cookie</code>, or
<code>hono/jwt</code>/<code>hono/jwk</code> are encouraged to upgrade to
this version.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="83bfb3bb4a"><code>83bfb3b</code></a>
4.12.23</li>
<li><a
href="bcd290a64c"><code>bcd290a</code></a>
fix(utils/ipaddr): do not compress a single 0 group to <code>::</code>
(<a
href="https://redirect.github.com/honojs/hono/issues/4971">#4971</a>)</li>
<li><a
href="c968177d9c"><code>c968177</code></a>
feat(compress): add contentTypeFilter option and
`COMPRESSIBLE_CONTENT_TYPE_R...</li>
<li><a
href="0265a5453a"><code>0265a54</code></a>
docs(contribution): add AI Usage Policy (<a
href="https://redirect.github.com/honojs/hono/issues/4970">#4970</a>)</li>
<li><a
href="c84c5d2d46"><code>c84c5d2</code></a>
feat(context): export the Context class publicly (<a
href="https://redirect.github.com/honojs/hono/issues/4543">#4543</a>)</li>
<li><a
href="82dad6297c"><code>82dad62</code></a>
fix(serve-static): normalize all backslashes in file paths, not just the
firs...</li>
<li><a
href="2f01b774b1"><code>2f01b77</code></a>
4.12.22</li>
<li><a
href="6bc0dff277"><code>6bc0dff</code></a>
feat: add msgpack as a compressible content type (<a
href="https://redirect.github.com/honojs/hono/issues/4957">#4957</a>)</li>
<li><a
href="7e0555d14c"><code>7e0555d</code></a>
fix(deno): echo negotiated WebSocket subprotocol in upgrade response (<a
href="https://redirect.github.com/honojs/hono/issues/4955">#4955</a>)</li>
<li><a
href="f0ed246591"><code>f0ed246</code></a>
fix(compress): respect Accept-Encoding when encoding option is set (<a
href="https://redirect.github.com/honojs/hono/issues/4951">#4951</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.18...v4.12.23">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from
1.5.32 to 1.5.34.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java "21" 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan="true" attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code><conversionRule></code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the "java.lang" and
"java.util" packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
"TLSv1.2". This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as "&" as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e62272ac15"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="1e9e926db1"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="2de5cbe90b"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="0e9b9278b5"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="f7a0654c2b"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="249b81f375"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="1c3b26a839"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="124e8b49b5"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="d8fd6f25c7"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="95edbeb8db"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the other-dependencies group with 2 updates in the
/samples/kotlin-mcp-client directory:
[com.anthropic:anthropic-java](https://github.com/anthropics/anthropic-sdk-java)
and [com.gradleup.shadow](https://github.com/GradleUp/shadow).
Bumps the other-dependencies group with 1 update in the
/samples/kotlin-mcp-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow).
Bumps the other-dependencies group with 2 updates in the
/samples/kotlinlang-mcp-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow) and
[ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the other-dependencies group with 1 update in the
/samples/simple-streamable-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow).
Bumps the other-dependencies group with 2 updates in the
/samples/weather-stdio-server directory:
[com.gradleup.shadow](https://github.com/GradleUp/shadow) and
[io.github.oshai:kotlin-logging-jvm](https://github.com/oshai/kotlin-logging).
Updates `com.anthropic:anthropic-java` from 2.34.0 to 2.35.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-java/releases">com.anthropic:anthropic-java's
releases</a>.</em></p>
<blockquote>
<h2>v2.35.0</h2>
<h2>2.35.0 (2026-05-28)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.1...v2.35.0">v2.34.1...v2.35.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> Add support for claude-opus-4-8,
mid-conversation system blocks, and usage.output_tokens_details (<a
href="3e4621e676">3e4621e</a>)</li>
</ul>
<h2>v2.34.1</h2>
<h2>2.34.1 (2026-05-27)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.0...v2.34.1">v2.34.0...v2.34.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>structured-outputs:</strong> support all nullability
annotations (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1254">#1254</a>)
(<a
href="95e4391443">95e4391</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>replace literal newlines (<a
href="c5573d98ef">c5573d9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-java/blob/main/CHANGELOG.md">com.anthropic:anthropic-java's
changelog</a>.</em></p>
<blockquote>
<h2>2.35.0 (2026-05-28)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.1...v2.35.0">v2.34.1...v2.35.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> Add support for claude-opus-4-8,
mid-conversation system blocks, and usage.output_tokens_details (<a
href="3e4621e676">3e4621e</a>)</li>
</ul>
<h2>2.34.1 (2026-05-27)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.0...v2.34.1">v2.34.0...v2.34.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>structured-outputs:</strong> support all nullability
annotations (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1254">#1254</a>)
(<a
href="95e4391443">95e4391</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>replace literal newlines (<a
href="c5573d98ef">c5573d9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="65d26cc371"><code>65d26cc</code></a>
release: 2.35.0</li>
<li><a
href="f901010691"><code>f901010</code></a>
feat(api): Add support for claude-opus-4-8, mid-conversation system
blocks, a...</li>
<li><a
href="bc1bdd9a38"><code>bc1bdd9</code></a>
release: 2.34.1</li>
<li><a
href="f27e209ac9"><code>f27e209</code></a>
fix(structured-outputs): support all nullability annotations (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1254">#1254</a>)</li>
<li><a
href="62ef906b3c"><code>62ef906</code></a>
docs: replace literal newlines</li>
<li><a
href="dc19d08217"><code>dc19d08</code></a>
ci: run breaking change detection on every branch (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-java/issues/1224">#1224</a>)</li>
<li><a
href="1382286f46"><code>1382286</code></a>
codegen metadata</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.34.0...v2.35.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java "21" 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan="true" attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code><conversionRule></code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the "java.lang" and
"java.util" packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
"TLSv1.2". This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as "&" as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e62272ac15"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="1e9e926db1"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="2de5cbe90b"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="0e9b9278b5"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="f7a0654c2b"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="249b81f375"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="1c3b26a839"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="124e8b49b5"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="d8fd6f25c7"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="95edbeb8db"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.github.oshai:kotlin-logging-jvm` from 8.0.03 to 8.0.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oshai/kotlin-logging/releases">io.github.oshai:kotlin-logging-jvm's
releases</a>.</em></p>
<blockquote>
<h2>8.0.4</h2>
<p>Align to semver.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/oshai/kotlin-logging/compare/8.0.03...8.0.4">https://github.com/oshai/kotlin-logging/compare/8.0.03...8.0.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0aaa57ccef"><code>0aaa57c</code></a>
bump to semver 8.0.5</li>
<li><a
href="bf60363f6c"><code>bf60363</code></a>
change to semver 8.0.4</li>
<li>See full diff in <a
href="https://github.com/oshai/kotlin-logging/compare/8.0.03...8.0.4">compare
view</a></li>
</ul>
</details>
<br />
Updates `com.gradleup.shadow` from 9.4.1 to 9.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/GradleUp/shadow/releases">com.gradleup.shadow's
releases</a>.</em></p>
<blockquote>
<h2>9.4.2</h2>
<h3>Changed</h3>
<ul>
<li>Update jdependency to support Java 27. (<a
href="https://redirect.github.com/GradleUp/shadow/pull/2033">#2033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29c432a7b6"><code>29c432a</code></a>
Prepare version 9.4.2</li>
<li><a
href="8aa8e6c1fb"><code>8aa8e6c</code></a>
Update dependency org.vafer:jdependency to v2.16 (<a
href="https://redirect.github.com/GradleUp/shadow/issues/2033">#2033</a>)</li>
<li>See full diff in <a
href="https://github.com/GradleUp/shadow/compare/9.4.1...9.4.2">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
fixes#573fixes#574fixes#708
- Handlers ran on `Dispatchers.IO` → now `Dispatchers.Default`,
configurable via `handlerDispatcher`.
- Reader/writer dispatcher exposed as `ioDispatcher` (default
`IODispatcher.limitedParallelism(2)`).
- Optional caller-supplied `CoroutineScope` so the pipeline isn't
detached from the caller's tree.
- `CancellationException` consistently rethrown across all pumps.
- Unbounded channels → bounded with graceful drain on close (in-flight
outbound flushed before `onClose`).
- Input `Source` now closed on natural EOF / reader error (was leaking
for non-`System.in` sources).
- Race between `start()` and `close()` fixed via 3-state CAS +
`setupComplete` barrier replacing `AtomicBoolean`.
## How Has This Been Tested?
unit and integration tests
## Breaking Changes
- Handlers default to `Dispatchers.Default` (was `Dispatchers.IO`).
Override with `handlerDispatcher = Dispatchers.IO` if your handlers
perform blocking I/O.
- `send()` suspends under back-pressure instead of buffering unbounded.
- `StdioServerTransport(input, output)` ctor is `@Deprecated` (WARNING)
in favor of `StdioServerTransport(input, output) { ... }`. Still
binary-compatible.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Bumps [qs](https://github.com/ljharb/qs) from 6.14.2 to 6.15.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.15.2</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + <code>encodeValuesOnly</code>
instead of crashing in <code>encoder</code></li>
<li>[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/555">#555</a>)</li>
<li>[Fix] <code>stringify</code>: apply <code>formatter</code> to
encoded key under <code>strictNullHandling</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/554">#554</a>)</li>
<li>[Fix] <code>stringify</code>: skip null/undefined filter-array
entries instead of crashing in <code>encoder</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/551">#551</a>)</li>
<li>[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests (<a
href="https://redirect.github.com/ljharb/qs/issues/530">#530</a>)</li>
<li>[readme] fix grammar (<a
href="https://redirect.github.com/ljharb/qs/issues/550">#550</a>)</li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li>[Tests] add regression tests for keys containing percent-encoded
bracket text</li>
</ul>
<h2><strong>6.15.1</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: <code>parameterLimit: Infinity</code> with
<code>throwOnLimitExceeded: true</code> silently drops all
parameters</li>
<li>[Deps] update <code>@ljharb/eslint-config</code></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>iconv-lite</code></li>
<li>[Tests] increase coverage</li>
</ul>
<h2><strong>6.15.0</strong></h2>
<ul>
<li>[New] <code>parse</code>: add <code>strictMerge</code> option to
wrap object/primitive conflicts in an array (<a
href="https://redirect.github.com/ljharb/qs/issues/425">#425</a>, <a
href="https://redirect.github.com/ljharb/qs/issues/122">#122</a>)</li>
<li>[Fix] <code>duplicates</code> option should not apply to bracket
notation keys (<a
href="https://redirect.github.com/ljharb/qs/issues/514">#514</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9aca4076fe"><code>9aca407</code></a>
v6.15.2</li>
<li><a
href="5e33d33447"><code>5e33d33</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li><a
href="21f80b33e5"><code>21f80b3</code></a>
[Fix] <code>stringify</code>: skip null/undefined entries in
<code>arrayFormat: 'comma'</code> + `e...</li>
<li><a
href="a0a81ea207"><code>a0a81ea</code></a>
[Fix] <code>stringify</code>: use configured <code>delimiter</code>
after <code>charsetSentinel</code></li>
<li><a
href="e3062f78f5"><code>e3062f7</code></a>
[Fix] <code>stringify</code>: apply <code>formatter</code> to encoded
key under <code>strictNullHandling</code></li>
<li><a
href="0c180a40ad"><code>0c180a4</code></a>
[Fix] <code>stringify</code>: skip null/undefined filter-array entries
instead of crashi...</li>
<li><a
href="3a8b94aec1"><code>3a8b94a</code></a>
[Tests] add regression tests for keys containing percent-encoded bracket
text</li>
<li><a
href="96755abd35"><code>96755ab</code></a>
[readme] fix grammar</li>
<li><a
href="a419ce5bbf"><code>a419ce5</code></a>
[Fix] <code>parse</code>: handle nested bracket groups and add
regression tests</li>
<li><a
href="3f5e1c528c"><code>3f5e1c5</code></a>
v6.15.1</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.14.2...v6.15.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the infrastructure group with 1 update in the / directory:
org.slf4j:slf4j-simple.
Updates `org.slf4j:slf4j-simple` from 2.0.17 to 2.0.18
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
closes#544
Replaces opaque `JsonObject?` modelling of `elicitation` with a typed
`ClientCapabilities.Elicitation` (`form`, `url`), and adds the new
`tasks` capability on both `ClientCapabilities` and `ServerCapabilities`
(with `list`, `cancel`, per-request-type augmentation). Wires capability
assertions for `tasks/*` methods and `notifications/tasks/status` into
`Client` and `ServerSession`
## How Has This Been Tested?
unit tests
## Breaking Changes
yes
now elicitation is a specific class in capabilities
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Drops`dev.mokksy:mokksy` dependency
## Motivation and Context
`mokksy` is a niche, single-maintainer library with very limited
external adoption, introduced by its own author. Keeping a test-only
dependency on it is unnecessary supply-chain exposure given that the two
patterns already used in this repo, `MockEngine` for transport-level
tests and `embeddedServer` for integration-level tests, cover everything
it provided.
## Breaking Changes
none
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Fixes the SSE client transport so that registered `onClose` callbacks
fire when the underlying SSE session ends — whether the server closes
the stream gracefully or an error event terminates it.
closes#437
## Motivation and Context
`SseClientTransport.collectMessages` already runs `closeResources()` in
its `finally` block when `session.incoming` completes, but it never
invoked the `onClose` callback chain. As a result, the MCP `Client` (and
any user code calling `transport.onClose { ... }`) had no way to detect
that the server-side SSE connection had dropped.
The other client transports already do this correctly:
- `StdioClientTransport` calls `invokeOnCloseCallback()` from its
read-loop `finally`
(kotlin-sdk-client/src/.../StdioClientTransport.kt:224).
- The protected `AbstractTransport.invokeOnCloseCallback()` helper
guards against duplicate firing with an `AtomicBoolean`, so it is safe
to call from both the read-loop `finally` and the user-initiated
`close()` path.
The fix mirrors that established pattern in one line.
## How Has This Been Tested?
Added `onClose callback fires when the SSE stream is disconnected by the
server` to `SseClientTransportTest`. The test:
1. Starts the transport against a mock SSE engine.
2. Closes the SSE byte channel server-side via a new
`MockSseClientEngine.disconnectSseStream()` helper.
3. Asserts the registered `onClose` callback fires (using Kotest
`eventually`, since the close propagates on a real-time dispatcher).
I also verified the test fails before the fix and passes after.
```
./gradlew :kotlin-sdk-client:jvmTest
./gradlew apiCheck ktlintCheck detekt
```
## Breaking Changes
None. `invokeOnCloseCallback()` is `protected` on `AbstractTransport`;
this PR only adds a call site inside `SseClientTransport`. No public API
surface changes.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps the other-dependencies group with 1 update in the
/samples/kotlin-mcp-client directory:
[com.anthropic:anthropic-java](https://github.com/anthropics/anthropic-sdk-java).
Updates `com.anthropic:anthropic-java` from 2.28.0 to 2.30.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-java/releases">com.anthropic:anthropic-java's
releases</a>.</em></p>
<blockquote>
<h2>v2.30.0</h2>
<h2>2.30.0 (2026-05-06)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.29.0...v2.30.0">v2.29.0...v2.30.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents multiagents and
outcomes, webhooks, vault validation (<a
href="e641d5fef0">e641d5f</a>)</li>
<li><strong>api:</strong> add support for Managed Agents multiagents and
outcomes, webhooks, vault validation (<a
href="60675993a7">6067599</a>)</li>
<li><strong>client:</strong> support proxy authentication (<a
href="d91fea2762">d91fea2</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> Adjust webhook configuration (<a
href="34ea5b41cb">34ea5b4</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>fix merge errors (<a
href="c390c200d0">c390c20</a>)</li>
</ul>
<h2>v2.29.0</h2>
<h2>2.29.0 (2026-05-05)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.28.0...v2.29.0">v2.28.0...v2.29.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>client:</strong> allow targeting a workspace for OIDC
federation token exchange (<a
href="578003afed">578003a</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>client:</strong> create one json mapper (<a
href="556ef492e5">556ef49</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>remove duplicated dokka setup (<a
href="d6b94f49fd">d6b94f4</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>remove bad semicolon (<a
href="ffb078b828">ffb078b</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-java/blob/main/CHANGELOG.md">com.anthropic:anthropic-java's
changelog</a>.</em></p>
<blockquote>
<h2>2.30.0 (2026-05-06)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.29.0...v2.30.0">v2.29.0...v2.30.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents multiagents and
outcomes, webhooks, vault validation (<a
href="e641d5fef0">e641d5f</a>)</li>
<li><strong>api:</strong> add support for Managed Agents multiagents and
outcomes, webhooks, vault validation (<a
href="60675993a7">6067599</a>)</li>
<li><strong>client:</strong> support proxy authentication (<a
href="d91fea2762">d91fea2</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> Adjust webhook configuration (<a
href="34ea5b41cb">34ea5b4</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>fix merge errors (<a
href="c390c200d0">c390c20</a>)</li>
</ul>
<h2>2.29.0 (2026-05-05)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.28.0...v2.29.0">v2.28.0...v2.29.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>client:</strong> allow targeting a workspace for OIDC
federation token exchange (<a
href="578003afed">578003a</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>client:</strong> create one json mapper (<a
href="556ef492e5">556ef49</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>remove duplicated dokka setup (<a
href="d6b94f49fd">d6b94f4</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>remove bad semicolon (<a
href="ffb078b828">ffb078b</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5f413b58a3"><code>5f413b5</code></a>
chore: release main</li>
<li><a
href="46baee82fc"><code>46baee8</code></a>
fix(api): Adjust webhook configuration</li>
<li><a
href="0ce73ea4cc"><code>0ce73ea</code></a>
feat(api): add support for Managed Agents multiagents and outcomes,
webhooks,...</li>
<li><a
href="337eb3b320"><code>337eb3b</code></a>
chore: fix merge errors</li>
<li><a
href="0a95f16aac"><code>0a95f16</code></a>
feat(api): add support for Managed Agents multiagents and outcomes,
webhooks,...</li>
<li><a
href="93912dd436"><code>93912dd</code></a>
feat(client): support proxy authentication</li>
<li><a
href="1fc9ab10ed"><code>1fc9ab1</code></a>
chore: release main</li>
<li><a
href="9e4cbbd750"><code>9e4cbbd</code></a>
feat(client): allow targeting a workspace for OIDC federation token
exchange</li>
<li><a
href="e8e5894535"><code>e8e5894</code></a>
perf(client): create one json mapper</li>
<li><a
href="726e6f4416"><code>726e6f4</code></a>
chore: remove duplicated dokka setup</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-java/compare/v2.28.0...v2.30.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.14 to 4.12.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.18</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Cache Middleware ignores Vary: Authorization / Vary: Cookie leading
to cross-user cache leakage</h3>
<p>Affects: Cache Middleware. Fixes missing cache-skip handling for
<code>Vary: Authorization</code> and <code>Vary: Cookie</code>, where a
response cached for one authenticated user could be served to other
users. GHSA-p77w-8qqv-26rm</p>
<h3>CSS Declaration Injection via Style Object Values in JSX SSR</h3>
<p>Affects: hono/jsx. Fixes a missing CSS-context escape for
<code>style</code> object values and property names, where untrusted
input could inject additional CSS declarations. The impact is limited to
CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p</p>
<h3>Improper validation of NumericDate claims (exp, nbf, iat) in JWT
verify()</h3>
<p>Affects: <code>hono/utils/jwt</code>. Fixes improper validation of
<code>exp</code>, <code>nbf</code>, and <code>iat</code> claims, where
falsy, non-finite, or non-numeric values could silently bypass
time-based checks instead of being rejected per RFC 7519.
GHSA-hm8q-7f3q-5f36</p>
<hr />
<p>Users who use the JWT helper, hono/jsx, or the Cache middleware are
strongly encouraged to upgrade to this version.</p>
<h2>v4.12.17</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jsx): normalize SVG attributes on the <!-- raw HTML omitted -->
root element by <a
href="https://github.com/kfly8"><code>@kfly8</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li>fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> by <a
href="https://github.com/yuintei"><code>@yuintei</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4899">honojs/hono#4899</a></li>
<li>fix(cors): make origin optional in CORSOptions by <a
href="https://github.com/truffle-dev"><code>@truffle-dev</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
<li>fix(types): propagate middleware response types to app.on overloads
by <a href="https://github.com/T4ko0522"><code>@T4ko0522</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4906">honojs/hono#4906</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kfly8"><code>@kfly8</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li><a
href="https://github.com/truffle-dev"><code>@truffle-dev</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.16...v4.12.17">https://github.com/honojs/hono/compare/v4.12.16...v4.12.17</a></p>
<h2>v4.12.16</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX tag names when
using <code>jsx()</code> or <code>createElement()</code>, which could
allow HTML injection if untrusted input is used as the tag name.
GHSA-69xw-7hcm-h432</p>
<h3>bodyLimit() can be bypassed for chunked / unknown-length
requests</h3>
<p>Affects: Body Limit Middleware. Fixes late enforcement for request
bodies without a reliable Content-Length (e.g. chunked requests), where
oversized requests could reach handlers and return successful responses
before being rejected. GHSA-9vqf-7f2p-gf9v</p>
<h2>v4.12.15</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jwt): support single-line PEM keys by <a
href="https://github.com/hiendv"><code>@hiendv</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4889">honojs/hono#4889</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f10dee89ce"><code>f10dee8</code></a>
4.12.18</li>
<li><a
href="a5bd9ebead"><code>a5bd9eb</code></a>
Merge commit from fork</li>
<li><a
href="58d3d3ad56"><code>58d3d3a</code></a>
Merge commit from fork</li>
<li><a
href="568c2ecc1d"><code>568c2ec</code></a>
Merge commit from fork</li>
<li><a
href="ff2b3d31df"><code>ff2b3d3</code></a>
4.12.17</li>
<li><a
href="52aaaf9714"><code>52aaaf9</code></a>
fix(types): propagate middleware response types to app.on overloads (<a
href="https://redirect.github.com/honojs/hono/issues/4906">#4906</a>)</li>
<li><a
href="76d5589e9b"><code>76d5589</code></a>
fix(cors): make origin optional in CORSOptions (<a
href="https://redirect.github.com/honojs/hono/issues/4905">#4905</a>)</li>
<li><a
href="8f027e5574"><code>8f027e5</code></a>
fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4899">#4899</a>)</li>
<li><a
href="bfba97ca7e"><code>bfba97c</code></a>
fix(jsx): normalize SVG attributes on the <svg> root element (<a
href="https://redirect.github.com/honojs/hono/issues/4893">#4893</a>)</li>
<li><a
href="90d4182aab"><code>90d4182</code></a>
4.12.16</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.14...v4.12.18">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the all-dependencies group with 1 update in the
/integration-test/src/jvmTest/typescript directory:
[zod](https://github.com/colinhacks/zod).
Updates `zod` from 4.3.6 to 4.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/colinhacks/zod/releases">zod's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.3</h2>
<h2>Commits:</h2>
<ul>
<li>4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary
wordmark for gold sponsor logo</li>
<li>2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold
sponsors and rebalance logo sizing</li>
<li>7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed
silver/bronze sponsors and add active ones</li>
<li>2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze
sponsor logos to github avatar pattern</li>
<li>9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from
bronze sponsors (churned)</li>
<li>b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and
Speakeasy (2+ missed monthly cycles)</li>
<li>1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch
handling for absent object keys (<a
href="https://redirect.github.com/colinhacks/zod/issues/5937">#5937</a>)
(<a
href="https://redirect.github.com/colinhacks/zod/issues/5939">#5939</a>)</li>
<li>c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize
optin/fallback to transform; restore preprocess on absent keys (<a
href="https://redirect.github.com/colinhacks/zod/issues/5941">#5941</a>)</li>
<li>f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3</li>
<li>1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release
procedure in AGENTS.md</li>
</ul>
<h2>v4.4.2</h2>
<h2>Commits:</h2>
<ul>
<li>0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation
and stale labels (<a
href="https://redirect.github.com/colinhacks/zod/issues/5901">#5901</a>)</li>
<li>20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy
and refresh tooling deps</li>
<li>6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor
links now include the hash so it doesnt scoll all the way up, follows
navbar logic (<a
href="https://redirect.github.com/colinhacks/zod/issues/5791">#5791</a>)</li>
<li>4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union
option typing</li>
<li>bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for
agents</li>
<li>cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking
branch 'origin/main' into fix-discriminated-union-key-constraint</li>
<li>292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold
sponsor</li>
<li>1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec
inversion</li>
<li>1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure
guidance</li>
<li>e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage
notes</li>
<li>e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab
code heights</li>
<li>905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess
input type narrowing</li>
<li>bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test
guidance in AGENTS.md</li>
<li>8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts
scratch</li>
<li>02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer
optionality to inner schema (<a
href="https://redirect.github.com/colinhacks/zod/issues/5929">#5929</a>)</li>
<li>88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated
<code>baseUrl</code> from tsconfig</li>
<li>c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2</li>
</ul>
<h2>v4.4.1</h2>
<h2>Commits:</h2>
<ul>
<li>481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing
on full test workflow</li>
<li>95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional
undefined expectations</li>
<li>cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes
before required defaults (<a
href="https://redirect.github.com/colinhacks/zod/issues/5900">#5900</a>)</li>
<li>edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1</li>
<li>180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured
sponsor</li>
</ul>
<h2>v4.4.0</h2>
<h2>4.4.0</h2>
<p>This is a minor release with a wide set of correctness and soundness
fixes. Some fixes intentionally make Zod stricter, so code that depended
on previously accepted invalid or ambiguous inputs may need small
updates.</p>
<h2>Potentially breaking bug fixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1fb56a5c18"><code>1fb56a5</code></a>
docs: document release procedure in AGENTS.md</li>
<li><a
href="f3c9ec03ba"><code>f3c9ec0</code></a>
4.4.3</li>
<li><a
href="c2be4f8190"><code>c2be4f8</code></a>
fix(v4): generalize optin/fallback to transform; restore preprocess on
absent...</li>
<li><a
href="1cab69383f"><code>1cab693</code></a>
fix(v4): restore catch handling for absent object keys (<a
href="https://redirect.github.com/colinhacks/zod/issues/5937">#5937</a>)
(<a
href="https://redirect.github.com/colinhacks/zod/issues/5939">#5939</a>)</li>
<li><a
href="b8dffe9e62"><code>b8dffe9</code></a>
docs: remove Numeric and Speakeasy (2+ missed monthly cycles)</li>
<li><a
href="9195250cab"><code>9195250</code></a>
docs: remove Mintlify from bronze sponsors (churned)</li>
<li><a
href="2c703322a2"><code>2c70332</code></a>
docs: normalize bronze sponsor logos to github avatar pattern</li>
<li><a
href="7391be88ac"><code>7391be8</code></a>
docs: prune lapsed silver/bronze sponsors and add active ones</li>
<li><a
href="2aeec83eb1"><code>2aeec83</code></a>
docs: prune lapsed gold sponsors and rebalance logo sizing</li>
<li><a
href="4c2fa95ce3"><code>4c2fa95</code></a>
docs: use Zernio primary wordmark for gold sponsor logo</li>
<li>Additional commits viewable in <a
href="https://github.com/colinhacks/zod/compare/v4.3.6...v4.4.3">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for zod since your current version.</p>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[org.jetbrains.kotlinx:kotlinx-serialization-json](https://github.com/Kotlin/kotlinx.serialization)
from 1.10.0 to 1.11.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kotlin/kotlinx.serialization/releases">org.jetbrains.kotlinx:kotlinx-serialization-json's
releases</a>.</em></p>
<blockquote>
<h2>1.11.0</h2>
<p>This release is based on Kotlin 2.3.20 and provides a new Json
exceptions API and some bugfixes and improvements.</p>
<h2>Expose Json exceptions structure</h2>
<p>To make working with exceptions easier and providing proper error
codes in e.g., REST APIs,
classes <code>JsonException</code>, <code>JsonDecodingException</code>,
and <code>JsonEncodingException</code> are now public.
They have relevant public properties, such as <code>shortMessage</code>,
<code>path</code>, <code>offset</code>, and others.
This API is currently experimental, and we're going to improve it
further in the subsequent releases.
See the linked issues for the details: <a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/1930">#1930</a>,
<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/1877">#1877</a>.</p>
<h2>Ability to hide user input from exception messages for
security/privacy reasons.</h2>
<p>Historically, exception messages in kotlinx.serialization often
included the input Json itself for debuggability reason.
Such behavior may pose additional challenges for logging, analytics, and
other systems, since
a system is not always allowed to store user data due to
privacy/security reasons, which imposes additional sanitation logic.
To address this issue, a new property
<code>exceptionsWithDebugInfo</code> is added to
<code>JsonConfiguration</code>.
Disable it to hide user input from exception messages.
IMPORTANT: This behavior will be enabled by default when this property
becomes stable.
See <a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/2590">#2590</a>
for more details.</p>
<h2>Bugfixes and improvements</h2>
<ul>
<li>CBOR: Relax value range check when decoding numbers (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3167">#3167</a>)</li>
<li>Use a specialized writeDecimalLong method for IO stream integrations
in Json (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3152">#3152</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kotlin/kotlinx.serialization/blob/master/CHANGELOG.md">org.jetbrains.kotlinx:kotlinx-serialization-json's
changelog</a>.</em></p>
<blockquote>
<h1>1.11.0 / 2026-04-10</h1>
<p>This release is based on Kotlin 2.3.20 and provides new Json
exceptions API and some bugfixes and improvements.</p>
<h2>Expose Json exceptions structure</h2>
<p>To make working with exceptions easier and providing proper error
codes in e.g., REST APIs,
classes <code>JsonException</code>, <code>JsonDecodingException</code>,
and <code>JsonEncodingException</code> are now public.
They have relevant public properties, such as <code>shortMessage</code>,
<code>path</code>, <code>offset</code>, and others.
This API is currently experimental, and we're going to improve it
further in the subsequent releases.
See the linked issues for the details: <a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/1930">#1930</a>,
<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/1877">#1877</a>.</p>
<h2>Ability to hide user input from exception messages for
security/privacy reasons.</h2>
<p>Historically, exception messages in kotlinx.serialization often
included the input Json itself for debuggability reason.
Such behavior may pose additional challenges for logging, analytics, and
other systems, since
a system is not always allowed to store user data due to
privacy/security reasons, which imposes additional sanitation logic.
To address this issue, a new property
<code>exceptionsWithDebugInfo</code> is added to
<code>JsonConfiguration</code>.
Disable it to hide user input from exception messages.
IMPORTANT: This behavior will be enabled by default when this property
becomes stable.
See <a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/2590">#2590</a>
for more details.</p>
<h2>Bugfixes and improvements</h2>
<ul>
<li>CBOR: Relax value range check when decoding numbers (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3167">#3167</a>)</li>
<li>Use a specialized writeDecimalLong method for IO stream integrations
in Json (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3152">#3152</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6956af2e60"><code>6956af2</code></a>
Prepare 1.11 release</li>
<li><a
href="390d84c68a"><code>390d84c</code></a>
Merge remote-tracking branch 'origin/master' into dev</li>
<li><a
href="431fe2dc0a"><code>431fe2d</code></a>
Use local repo for publishing (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3171">#3171</a>)</li>
<li><a
href="05c12b60a6"><code>05c12b6</code></a>
Add usage attribute to "testRepositories" configuration</li>
<li><a
href="a4e1f082ef"><code>a4e1f08</code></a>
Bump Kover version to 0.9.8 release (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3174">#3174</a>)</li>
<li><a
href="304e858ccc"><code>304e858</code></a>
Expose Json exceptions structure (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3145">#3145</a>)</li>
<li><a
href="4a0338ef50"><code>4a0338e</code></a>
Included G Play SDK verification file for core-jvm (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3169">#3169</a>)</li>
<li><a
href="421f64c74f"><code>421f64c</code></a>
CBOR: Relax value range check when decoding numbers (<a
href="https://redirect.github.com/Kotlin/kotlinx.serialization/issues/3167">#3167</a>)</li>
<li><a
href="85a4f126ec"><code>85a4f12</code></a>
KT-84955: mark apple x64 tagets as deprecated error</li>
<li><a
href="bd38b0e49b"><code>bd38b0e</code></a>
Remove dead code</li>
<li>Additional commits viewable in <a
href="https://github.com/Kotlin/kotlinx.serialization/compare/v1.10.0...v1.11.0">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `kotlin` from 2.3.20 to 2.3.21.
Updates `org.jetbrains.kotlin.jvm` from 2.3.20 to 2.3.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/releases">org.jetbrains.kotlin.jvm's
releases</a>.</em></p>
<blockquote>
<h2>Kotlin 2.3.21</h2>
<h2>Changelog</h2>
<h3>Backend. Wasm</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84610"><code>KT-84610</code></a>
[Wasm] Failed to compile klibs in IC mode</li>
</ul>
<h3>Compiler</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84566"><code>KT-84566</code></a>
Prevent launching Default dispatcher threads from IJ SDK in kotlin
compiler</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85358"><code>KT-85358</code></a>
Native: roll back the workaround for KT-84678 once MapLibre has been
properly fixed</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85626"><code>KT-85626</code></a>
<code>@JvmRecord</code> in commonMain breaks
compileCommonMainKotlinMetadata with "Cannot access
'java.lang.Record'"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85405"><code>KT-85405</code></a>
Postpone/Revert
<code>DontIgnoreUpperBoundViolatedOnImplicitArguments</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84678"><code>KT-84678</code></a>
K/N: Undefined symbol from SPM-added ObjC frameworks when linking iOS
target</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85021"><code>KT-85021</code></a>
False positive SUBCLASS_CANT_CALL_COMPANION_PROTECTED_NON_STATIC error
in multi-module project</li>
</ul>
<h3>JavaScript</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82395"><code>KT-82395</code></a>
Support top-level declarations from compiler plugins in JS incremental
compilation</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84475"><code>KT-84475</code></a>
K/JS: false-positive exportability warnings in multi-module project</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84633"><code>KT-84633</code></a>
Kotlin/JS: "Serializer for class not found" error when IR
output granularity is <code>whole-program</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85047"><code>KT-85047</code></a>
Kotlin/JS: <code>@JsStatic</code> on suspend fun of class companion
generates incorrect d.ts</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84517"><code>KT-84517</code></a>
K/JS: bad mappings data in outputted Kotlin stdlib source map</li>
</ul>
<h3>Libraries</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71848"><code>KT-71848</code></a>
Kotlinx.metadata: Add <code>CompilerPluginData</code> into Km API</li>
</ul>
<h3>Native. C and ObjC Import</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85399"><code>KT-85399</code></a>
Kotlin/Native: TypeCastException when casting ObjC Protocol MetaClass
with genericSafeCasts enabled</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85508"><code>KT-85508</code></a>
K/N: TypeCastException when using nw_parameters_create_secure_tcp block
parameter on 2.3.20</li>
</ul>
<h3>Tools. Gradle</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84729"><code>KT-84729</code></a>
Update Gradle plugin-publish version to enable configuration cache badge
on Gradle plugins portal</li>
</ul>
<h3>Tools. Gradle. Compiler plugins</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85257"><code>KT-85257</code></a>
AGP/Compose: MergeMappingFileTask clears R8 artifacts due to
<code>@OutputDirectory</code> annotation on AGP 9.1+</li>
</ul>
<h3>Tools. Scripts</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85105"><code>KT-85105</code></a>
Scripts: JVM backend internal error (IR lowering) when scratch file
contains anonymous object</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85103"><code>KT-85103</code></a>
Exception while generating code when explain destructuring decls</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84842"><code>KT-84842</code></a>
scriptCompilationClasspathFromContext behavior changed from 2.3.10 to
2.3.20</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85029"><code>KT-85029</code></a>
Kotlin Scripting: ScriptDiagnostic reports "at null" instead
of error location</li>
</ul>
<h3>Tools. Statistics (FUS)</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md">org.jetbrains.kotlin.jvm's
changelog</a>.</em></p>
<blockquote>
<h2>2.3.21</h2>
<h3>Backend. Wasm</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84610"><code>KT-84610</code></a>
[Wasm] Failed to compile klibs in IC mode</li>
</ul>
<h3>Compiler</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84566"><code>KT-84566</code></a>
Prevent launching Default dispatcher threads from IJ SDK in kotlin
compiler</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85358"><code>KT-85358</code></a>
Native: roll back the workaround for KT-84678 once MapLibre has been
properly fixed</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85626"><code>KT-85626</code></a>
<code>@JvmRecord</code> in commonMain breaks
compileCommonMainKotlinMetadata with "Cannot access
'java.lang.Record'"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85405"><code>KT-85405</code></a>
Postpone/Revert
<code>DontIgnoreUpperBoundViolatedOnImplicitArguments</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84678"><code>KT-84678</code></a>
K/N: Undefined symbol from SPM-added ObjC frameworks when linking iOS
target</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85021"><code>KT-85021</code></a>
False positive SUBCLASS_CANT_CALL_COMPANION_PROTECTED_NON_STATIC error
in multi-module project</li>
</ul>
<h3>JavaScript</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82395"><code>KT-82395</code></a>
Support top-level declarations from compiler plugins in JS incremental
compilation</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84475"><code>KT-84475</code></a>
K/JS: false-positive exportability warnings in multi-module project</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84633"><code>KT-84633</code></a>
Kotlin/JS: "Serializer for class not found" error when IR
output granularity is <code>whole-program</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85047"><code>KT-85047</code></a>
Kotlin/JS: <code>@JsStatic</code> on suspend fun of class companion
generates incorrect d.ts</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84517"><code>KT-84517</code></a>
K/JS: bad mappings data in outputted Kotlin stdlib source map</li>
</ul>
<h3>Libraries</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71848"><code>KT-71848</code></a>
Kotlinx.metadata: Add <code>CompilerPluginData</code> into Km API</li>
</ul>
<h3>Native. C and ObjC Import</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85399"><code>KT-85399</code></a>
Kotlin/Native: TypeCastException when casting ObjC Protocol MetaClass
with genericSafeCasts enabled</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85508"><code>KT-85508</code></a>
K/N: TypeCastException when using nw_parameters_create_secure_tcp block
parameter on 2.3.20</li>
</ul>
<h3>Tools. Gradle</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84729"><code>KT-84729</code></a>
Update Gradle plugin-publish version to enable configuration cache badge
on Gradle plugins portal</li>
</ul>
<h3>Tools. Gradle. Compiler plugins</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85257"><code>KT-85257</code></a>
AGP/Compose: MergeMappingFileTask clears R8 artifacts due to
<code>@OutputDirectory</code> annotation on AGP 9.1+</li>
</ul>
<h3>Tools. Scripts</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85105"><code>KT-85105</code></a>
Scripts: JVM backend internal error (IR lowering) when scratch file
contains anonymous object</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85103"><code>KT-85103</code></a>
Exception while generating code when explain destructuring decls</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84842"><code>KT-84842</code></a>
scriptCompilationClasspathFromContext behavior changed from 2.3.10 to
2.3.20</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85029"><code>KT-85029</code></a>
Kotlin Scripting: ScriptDiagnostic reports "at null" instead
of error location</li>
</ul>
<h3>Tools. Statistics (FUS)</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85628"><code>KT-85628</code></a>
KGP: composite build FUS metrics fail on access of
'configurationTimeMetrics'</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fea1ad8c18"><code>fea1ad8</code></a>
Add ChangeLog for 2.3.21-RC2</li>
<li><a
href="09c341e858"><code>09c341e</code></a>
disable swift export execution tests in order to update macos</li>
<li><a
href="67a08681cd"><code>67a0868</code></a>
Avoid accessing KotlinNativeLink taskProvider when task was not
executed</li>
<li><a
href="f89e5dbc18"><code>f89e5db</code></a>
[K/N] Disable TSAN in runtime tests</li>
<li><a
href="45d6c859c0"><code>45d6c85</code></a>
[K/N] Don't generate generic safe casts for Objective-C types</li>
<li><a
href="9261a6f079"><code>9261a6f</code></a>
[K/N][tests] Add a reproducer for KT-85508</li>
<li><a
href="c9ab9db37a"><code>c9ab9db</code></a>
[K/N][tests] Add a reproducer for KT-85399</li>
<li><a
href="502e84484e"><code>502e844</code></a>
Explain: fix for destructuring declarations</li>
<li><a
href="0c26485d83"><code>0c26485</code></a>
Explain: fix for object literals</li>
<li><a
href="68a9e3f99f"><code>68a9e3f</code></a>
[minor] fix testdata name in explain test</li>
<li>Additional commits viewable in <a
href="https://github.com/JetBrains/kotlin/compare/v2.3.20...v2.3.21">compare
view</a></li>
</ul>
</details>
<br />
Updates `org.jetbrains.kotlin.plugin.serialization` from 2.3.20 to
2.3.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/releases">org.jetbrains.kotlin.plugin.serialization's
releases</a>.</em></p>
<blockquote>
<h2>Kotlin 2.3.21</h2>
<h2>Changelog</h2>
<h3>Backend. Wasm</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84610"><code>KT-84610</code></a>
[Wasm] Failed to compile klibs in IC mode</li>
</ul>
<h3>Compiler</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84566"><code>KT-84566</code></a>
Prevent launching Default dispatcher threads from IJ SDK in kotlin
compiler</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85358"><code>KT-85358</code></a>
Native: roll back the workaround for KT-84678 once MapLibre has been
properly fixed</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85626"><code>KT-85626</code></a>
<code>@JvmRecord</code> in commonMain breaks
compileCommonMainKotlinMetadata with "Cannot access
'java.lang.Record'"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85405"><code>KT-85405</code></a>
Postpone/Revert
<code>DontIgnoreUpperBoundViolatedOnImplicitArguments</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84678"><code>KT-84678</code></a>
K/N: Undefined symbol from SPM-added ObjC frameworks when linking iOS
target</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85021"><code>KT-85021</code></a>
False positive SUBCLASS_CANT_CALL_COMPANION_PROTECTED_NON_STATIC error
in multi-module project</li>
</ul>
<h3>JavaScript</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82395"><code>KT-82395</code></a>
Support top-level declarations from compiler plugins in JS incremental
compilation</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84475"><code>KT-84475</code></a>
K/JS: false-positive exportability warnings in multi-module project</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84633"><code>KT-84633</code></a>
Kotlin/JS: "Serializer for class not found" error when IR
output granularity is <code>whole-program</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85047"><code>KT-85047</code></a>
Kotlin/JS: <code>@JsStatic</code> on suspend fun of class companion
generates incorrect d.ts</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84517"><code>KT-84517</code></a>
K/JS: bad mappings data in outputted Kotlin stdlib source map</li>
</ul>
<h3>Libraries</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71848"><code>KT-71848</code></a>
Kotlinx.metadata: Add <code>CompilerPluginData</code> into Km API</li>
</ul>
<h3>Native. C and ObjC Import</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85399"><code>KT-85399</code></a>
Kotlin/Native: TypeCastException when casting ObjC Protocol MetaClass
with genericSafeCasts enabled</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85508"><code>KT-85508</code></a>
K/N: TypeCastException when using nw_parameters_create_secure_tcp block
parameter on 2.3.20</li>
</ul>
<h3>Tools. Gradle</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84729"><code>KT-84729</code></a>
Update Gradle plugin-publish version to enable configuration cache badge
on Gradle plugins portal</li>
</ul>
<h3>Tools. Gradle. Compiler plugins</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85257"><code>KT-85257</code></a>
AGP/Compose: MergeMappingFileTask clears R8 artifacts due to
<code>@OutputDirectory</code> annotation on AGP 9.1+</li>
</ul>
<h3>Tools. Scripts</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85105"><code>KT-85105</code></a>
Scripts: JVM backend internal error (IR lowering) when scratch file
contains anonymous object</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85103"><code>KT-85103</code></a>
Exception while generating code when explain destructuring decls</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84842"><code>KT-84842</code></a>
scriptCompilationClasspathFromContext behavior changed from 2.3.10 to
2.3.20</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85029"><code>KT-85029</code></a>
Kotlin Scripting: ScriptDiagnostic reports "at null" instead
of error location</li>
</ul>
<h3>Tools. Statistics (FUS)</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md">org.jetbrains.kotlin.plugin.serialization's
changelog</a>.</em></p>
<blockquote>
<h2>2.3.21</h2>
<h3>Backend. Wasm</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84610"><code>KT-84610</code></a>
[Wasm] Failed to compile klibs in IC mode</li>
</ul>
<h3>Compiler</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84566"><code>KT-84566</code></a>
Prevent launching Default dispatcher threads from IJ SDK in kotlin
compiler</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85358"><code>KT-85358</code></a>
Native: roll back the workaround for KT-84678 once MapLibre has been
properly fixed</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85626"><code>KT-85626</code></a>
<code>@JvmRecord</code> in commonMain breaks
compileCommonMainKotlinMetadata with "Cannot access
'java.lang.Record'"</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85405"><code>KT-85405</code></a>
Postpone/Revert
<code>DontIgnoreUpperBoundViolatedOnImplicitArguments</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84678"><code>KT-84678</code></a>
K/N: Undefined symbol from SPM-added ObjC frameworks when linking iOS
target</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85021"><code>KT-85021</code></a>
False positive SUBCLASS_CANT_CALL_COMPANION_PROTECTED_NON_STATIC error
in multi-module project</li>
</ul>
<h3>JavaScript</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-82395"><code>KT-82395</code></a>
Support top-level declarations from compiler plugins in JS incremental
compilation</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84475"><code>KT-84475</code></a>
K/JS: false-positive exportability warnings in multi-module project</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84633"><code>KT-84633</code></a>
Kotlin/JS: "Serializer for class not found" error when IR
output granularity is <code>whole-program</code></li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85047"><code>KT-85047</code></a>
Kotlin/JS: <code>@JsStatic</code> on suspend fun of class companion
generates incorrect d.ts</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84517"><code>KT-84517</code></a>
K/JS: bad mappings data in outputted Kotlin stdlib source map</li>
</ul>
<h3>Libraries</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-71848"><code>KT-71848</code></a>
Kotlinx.metadata: Add <code>CompilerPluginData</code> into Km API</li>
</ul>
<h3>Native. C and ObjC Import</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85399"><code>KT-85399</code></a>
Kotlin/Native: TypeCastException when casting ObjC Protocol MetaClass
with genericSafeCasts enabled</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85508"><code>KT-85508</code></a>
K/N: TypeCastException when using nw_parameters_create_secure_tcp block
parameter on 2.3.20</li>
</ul>
<h3>Tools. Gradle</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84729"><code>KT-84729</code></a>
Update Gradle plugin-publish version to enable configuration cache badge
on Gradle plugins portal</li>
</ul>
<h3>Tools. Gradle. Compiler plugins</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85257"><code>KT-85257</code></a>
AGP/Compose: MergeMappingFileTask clears R8 artifacts due to
<code>@OutputDirectory</code> annotation on AGP 9.1+</li>
</ul>
<h3>Tools. Scripts</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85105"><code>KT-85105</code></a>
Scripts: JVM backend internal error (IR lowering) when scratch file
contains anonymous object</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85103"><code>KT-85103</code></a>
Exception while generating code when explain destructuring decls</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-84842"><code>KT-84842</code></a>
scriptCompilationClasspathFromContext behavior changed from 2.3.10 to
2.3.20</li>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85029"><code>KT-85029</code></a>
Kotlin Scripting: ScriptDiagnostic reports "at null" instead
of error location</li>
</ul>
<h3>Tools. Statistics (FUS)</h3>
<ul>
<li><a
href="https://youtrack.jetbrains.com/issue/KT-85628"><code>KT-85628</code></a>
KGP: composite build FUS metrics fail on access of
'configurationTimeMetrics'</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fea1ad8c18"><code>fea1ad8</code></a>
Add ChangeLog for 2.3.21-RC2</li>
<li><a
href="09c341e858"><code>09c341e</code></a>
disable swift export execution tests in order to update macos</li>
<li><a
href="67a08681cd"><code>67a0868</code></a>
Avoid accessing KotlinNativeLink taskProvider when task was not
executed</li>
<li><a
href="f89e5dbc18"><code>f89e5db</code></a>
[K/N] Disable TSAN in runtime tests</li>
<li><a
href="45d6c859c0"><code>45d6c85</code></a>
[K/N] Don't generate generic safe casts for Objective-C types</li>
<li><a
href="9261a6f079"><code>9261a6f</code></a>
[K/N][tests] Add a reproducer for KT-85508</li>
<li><a
href="c9ab9db37a"><code>c9ab9db</code></a>
[K/N][tests] Add a reproducer for KT-85399</li>
<li><a
href="502e84484e"><code>502e844</code></a>
Explain: fix for destructuring declarations</li>
<li><a
href="0c26485d83"><code>0c26485</code></a>
Explain: fix for object literals</li>
<li><a
href="68a9e3f99f"><code>68a9e3f</code></a>
[minor] fix testdata name in explain test</li>
<li>Additional commits viewable in <a
href="https://github.com/JetBrains/kotlin/compare/v2.3.20...v2.3.21">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Mukunda Rao Katta
dependabot[bot]
Pavel Gorgulov
johny