- Updated `detekt.yml` to exclude test folders from
`EmptyFunctionBlock`, `LargeClass`, and `LongMethod` checks.
- Cleanup detekt-baseline files.
- Simplified `.idea/detekt.xml`.
## Motivation and Context
To reduce linter noise and reduce tension
## How Has This Been Tested?
`./gradlew detekt`
## Breaking Changes
No
## Types of changes
- [x] Build tool/ci update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
#567
## Rethrow CancellationException in StdioServerTransport, fix ReadBuffer
### Changes
1. StdioServerTransport
- Replace generic `Throwable` catches with specific
`CancellationException` and `Exception` for clarity and correctness.
**breaking change** `Throwable` is not handled any more!
- Refactor launching jobs to separate methods
- Introduce `READ_BUFFER_SIZE` constant to replace inline buffer size
literals.
- Add suppress annotations for clearer intent and constructor
documentation for better usability.
- Extend StdioServerTransportTest
2. ReadBuffer
Previously, readMessage() returned null after consuming an unparseable
line even when more complete lines existed in the buffer. This caused
valid messages following a bad line in the same chunk to be silently
dropped until the next chunk arrived (or forever, in tests).
Fix the loop so null means only "no complete line available", not
"encountered a parse failure". Blank/whitespace-only lines are now
silently skipped via isBlank() rather than forwarded to the deserializer
and logged as errors.
Refactor the method into three focused helpers:
- readMessage() — outer loop over lines
- readLine() — consume the next newline-delimited line from the buffer
- tryRecover() — attempt deserialization from the first '{' onward
3. Add utility method `runIntegrationTest` for integration testing
(`runBlocking` + `withTimeout`). Use it in StdioServerTransportTest
4. Store processing Job reference and `calcelAndJoin()` it on close.
Partially addressing #574
## Motivation and Context
See #575, #564, #242
## How Has This Been Tested?
Unit test added
## Breaking Changes
Semantic change: `Throwable` and CancellationException are not handled
any more!
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
ci: update Codecov configuration for test and coverage upload
- Unified usage of `codecov/codecov-action@v5` for both test results and
coverage upload.
- Added `CODECOV_TOKEN` and `report_type` parameters for improved
configuration.
## Motivation and Context
Actually, CODECOV_TOKEN is required, even though the CodeCov banner
previously said the project can upload without a token.
## How Has This Been Tested?
CI
## Breaking Changes
No
## Types of changes
- [x] CI fix
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
Bumps [dev.mokksy:mokksy](https://github.com/mokksy/ai-mocks) from 0.6.2
to 0.8.0.
- Update dependency and migrate to new API
---------
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Konstantin Pavlov <1517853+kpavlov@users.noreply.github.com>
## Add Codecov coverage upload and XML report generation
- Add `koverXmlReport` to Gradle tasks in Ubuntu workflow
- Configure Codecov action to upload coverage reports
Reports will be available on
https://app.codecov.io/gh/modelcontextprotocol/kotlin-sdk
## Motivation and Context
To provide better test coverage visibility
## How Has This Been Tested?
CI
## Breaking Changes
No
## Types of changes
- [x] CI update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
## Introduce Configuration class for StreamableHttpServerTransport
Replace the six-parameter flat constructor of
`StreamableHttpServerTransport` with a typed `Configuration` class. This
improves API ergonomics, enables structural equality and copy(), and
provides a stable extension point for future options without further
breaking the constructor signature.
### Changes:
- Add `Configuration` as a public class nested directly on
`StreamableHttpServerTransport`, with `enableJsonResponse` as the first
parameter (most commonly set)
- Change the primary constructor to accept `Configuration`.
- Rename `retryIntervalMillis: Long?` to `retryInterval: Duration?` in
Configuration, aligning with Kotlin's type-safe time API
- Deprecate the old flat constructor with a compatibility bridge
- Update KotlinTestBase integration test to use the new constructor
- Enable test
AbstractResourceIntegrationTest.testSubscribeAndUnsubscribe() since #249
is closed
## Motivation and Context
The current StreamableHttpServerTransport API cannot be easily extended:
adding more parameters would be a breaking change. But this is already
needed for #521.
This PR is a prerequisite for #535
## How Has This Been Tested?
Regression tests
## Breaking Changes
No. Current StreamableHttpServerTransport constructor was deprecated
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Summary
Fix SSE endpoint resolution so absolute paths resolve against the
origin, and add tests covering absolute vs relative endpoint events.
## Motivation and Context
The SSE transport currently resolves all endpoint events against the SSE
URL’s base path. When the server sends an absolute endpoint (starting
with `/`), the client incorrectly prefixes it with the SSE path. This
change resolves absolute endpoints against the origin while keeping
relative behavior unchanged.
addresses: https://github.com/modelcontextprotocol/kotlin-sdk/issues/329
## How Has This Been Tested?
Unit tests added in `SseClientTransportTest` for absolute and relative
endpoint events.
## Breaking Changes
No.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
The endpoint resolution logic now treats paths starting with `/` as
origin-relative. Relative paths continue to resolve against the SSE base
URL.
## Motivation and Context
Adds a `ClientConnection` context receiver to server call handlers,
which provides access to the client communication channel. This is
necessary to allow tools to send notifications, logging, elicitations,
etc.
Supersedes https://github.com/modelcontextprotocol/kotlin-sdk/pull/144,
discussed in
https://github.com/modelcontextprotocol/kotlin-sdk/issues/295.
## How Has This Been Tested?
With the added integration test.
## Breaking Changes
It breaks binary compatibility and breaks source compatibility for tool
handlers that already use `this`.
If you care a lot about maintaining compatibility, I could add some
overloads to ease the transition. But the new methods would likely need
to be named differently for resolution.
Future compatibility should be easier to maintain - `Context` is an
interface (with experimental opt-in subclassing), so new fields can be
added without breaking compatibility. Different types could also be
introduced for different handles without breaking compatibility, as long
as they extend `ClientConnection`.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Co-authored-by: Konstantin Pavlov <1517853+kpavlov@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Replace `withTimeout` with `eventually` in test assertions and improve
readability in exception handling
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [x] Test update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
# Migrate Ktor extension functions from `Routing` to `Route` (#237)
- Replaced `Routing` with `Route` in MCP-related functions for better
composability in nested contexts.
- Updated tests to verify compatibility with nested routes and subpaths.
- Deprecated legacy signatures and removed redundant overloads.
## How Has This Been Tested?
Unit test
## Breaking Changes
`Routing.mcp(...) `extension was replaced with `Route.mcp(...)`
## Types of changes
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
Based on #314 by @IainHull but that PR is too outdated.
# Add DSL builder tests for Request, Capabilities, and Content types
- Introduced unit tests for `RequestDslTest`, `CapabilitiesDslTest`, and
`ContentDslTest` to validate DSL builder functionality.
- Covered edge cases, nested properties, custom fields, and overwrite
behavior for requests, capabilities, and content creation.
- Update AGENTS.md
## Motivation and Context
for confidence
## Breaking Changes
No
## Types of changes
- [x] Tests
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
- Introduced `withTimeout` to avoid indefinite hangs during test
execution (#514)
## Motivation and Context
Workaround for #514 in tests
## How Has This Been Tested?
Integration test updated, CI
## Breaking Changes
No
## Types of changes
- [x] Test fix
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
#514
1. Migrate test-utils module to multiplatform, add serialization
utilities
- Migrated `test-utils` to support Kotlin Multiplatform (JVM, JS,
Native).
- Added `verifySerialization`, `verifyDeserialization`,
`verifySerializationRoundTrip` utilities to streamline and validate JSON
serialization/deserialization
2. Refactor serialization tests to use test serialization utilities
- Updated serialization tests across the project to use
`verifySerialization` and `verifyDeserialization` utilities.
- Improved consistency and ensured proper round-trip validation for JSON
deserialization.
3. Remove some detekt baseline files and suppress `LongMethod` findings
- Deleted detekt baseline XML files for test sources.
- Suppressed `LongMethod` findings in relevant tests using `@Suppress`
annotations.
- Replaced empty method implementations with explicit `// noop` comments
for clarity.
- Adjusted min test coverage threshold in `build.gradle.kts`.
## Motivation and Context
To improve serialization testing
## How Has This Been Tested?
Unit tests
## Breaking Changes
No
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [x] Refactoring
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
Add $defs support in ToolSchema and update tests.
Motivation and Context
Fix parsing when tool schemas include $defs.
How Has This Been Tested?
`./gradlew :kotlin-sdk-core:jvmTest --tests
"io.modelcontextprotocol.kotlin.sdk.types.ToolsTest"`
Breaking Changes
No.
Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
Checklist
- [x] I have read the MCP Documentation
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
Additional context
N/A
# feat: Add kotlin-sdk-testing module with channel-based transport
implementation
- Introduced `kotlin-sdk-testing` module for testing utilities in the
MCP Kotlin SDK.
- Implemented `ChannelTransport`, providing JSON-RPC transport via
Kotlin coroutines channels.
<!-- Provide a brief summary of your changes -->
## Motivation and Context
This ChannelTransport can be used for testing Server implementation
without using real transports.
## How Has This Been Tested?
Unit test
## Breaking Changes
No
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Bumps gradle-wrapper from 9.3.0 to 9.3.1.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Konstantin Pavlov <1517853+kpavlov@users.noreply.github.com>
# Detekt setup hardeing; address some issues
- Address some detekt findings: missing KDocs, formatting, use `check*`
& `orEmpty()``
- Remove unnecessary KDoc comments from deprecated classes in `types.kt`
- Add Detekt baseline XML files for all modules
- Enforce stricter Detekt rules by setting `failOnSeverity` from `None`
to `Error`
## Motivation and Context
Detekt is not actually failing the build on violations. This PR is
enabling Detekt to fail on errors. Baseline fines added for historical
issues. Follow-up for #501
## How Has This Been Tested?
Regressions
## Breaking Changes
No breaking changes.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Refactoring
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
Bumps the npm_and_yarn group with 2 updates in the
/integration-test/src/jvmTest/typescript directory:
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
and [qs](https://github.com/ljharb/qs).
Updates `@modelcontextprotocol/sdk` from 1.25.2 to 1.26.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases"><code>@modelcontextprotocol/sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.26.0</h2>
<p>Addresses "Sharing server/transport instances can leak
cross-client response data" in this GHSA <a
href="https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7">https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7</a></p>
<h2>What's Changed</h2>
<ul>
<li>chore: bump v1.25.3 for backport fixes by <a
href="https://github.com/pcarleton"><code>@pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1412">modelcontextprotocol/typescript-sdk#1412</a></li>
<li>fix(deps): resolve npm audit vulnerabilities and bump dependencies
(v1.x backport) by <a
href="https://github.com/samuv"><code>@samuv</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1382">modelcontextprotocol/typescript-sdk#1382</a></li>
<li>Fix <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1430">#1430</a>:
Client Credentials providers scopes support (backported) by <a
href="https://github.com/NSeydoux"><code>@NSeydoux</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1442">modelcontextprotocol/typescript-sdk#1442</a></li>
<li>chore: bump version to 1.26.0 by <a
href="https://github.com/pcarleton"><code>@pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1479">modelcontextprotocol/typescript-sdk#1479</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/samuv"><code>@samuv</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1382">modelcontextprotocol/typescript-sdk#1382</a></li>
<li><a href="https://github.com/NSeydoux"><code>@NSeydoux</code></a>
made their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1442">modelcontextprotocol/typescript-sdk#1442</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.3...v1.26.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.3...v1.26.0</a></p>
<h2>v1.25.3</h2>
<h2>What's Changed</h2>
<ul>
<li>[v1.x backport] Use correct schema for client sampling validation
when tools are present by <a
href="https://github.com/olaservo"><code>@olaservo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1407">modelcontextprotocol/typescript-sdk#1407</a></li>
<li>fix: prevent Hono from overriding global Response object (v1.x) by
<a href="https://github.com/mattzcarey"><code>@mattzcarey</code></a> in
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1411">modelcontextprotocol/typescript-sdk#1411</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.2...v1.25.3">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.2...v1.25.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe9c07b465"><code>fe9c07b</code></a>
chore: bump version to 1.26.0 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1479">#1479</a>)</li>
<li><a
href="4f01e7e070"><code>4f01e7e</code></a>
fix: add non-null assertions for optional setupServer fields in stateful
test</li>
<li><a
href="a05be176ca"><code>a05be17</code></a>
Merge commit from fork</li>
<li><a
href="50d9fa3cd1"><code>50d9fa3</code></a>
Fix <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1430">#1430</a>:
Client Credentials providers scopes support (backported) (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1442">#1442</a>)</li>
<li><a
href="aa81a66556"><code>aa81a66</code></a>
fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x
back...</li>
<li><a
href="6aba065965"><code>6aba065</code></a>
chore: bump v1.25.3 for backport fixes (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1412">#1412</a>)</li>
<li><a
href="6e8f7e1a43"><code>6e8f7e1</code></a>
fix: prevent Hono from overriding global Response object (v1.x) (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1411">#1411</a>)</li>
<li><a
href="12ae856cee"><code>12ae856</code></a>
[v1.x backport] Use correct schema for client sampling validation when
tools ...</li>
<li>See full diff in <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.2...v1.26.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `qs` from 6.14.1 to 6.14.2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.14.2</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/546">#546</a>)</li>
<li>[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li>
<li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded
with indexed notation when <code>throwOnLimitExceeded</code> is true (<a
href="https://redirect.github.com/ljharb/qs/issues/529">#529</a>)</li>
<li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as
max index; remove extraneous comments (<a
href="https://redirect.github.com/ljharb/qs/issues/545">#545</a>)</li>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bdcf0c7f82"><code>bdcf0c7</code></a>
v6.14.2</li>
<li><a
href="294db90c81"><code>294db90</code></a>
[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output</li>
<li><a
href="5c308e5516"><code>5c308e5</code></a>
[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code>
documentation</li>
<li><a
href="6addf8cf73"><code>6addf8c</code></a>
[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code></li>
<li><a
href="cfc108f662"><code>cfc108f</code></a>
[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/`pars...</li>
<li><a
href="febb64442a"><code>febb644</code></a>
[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with
indexed notation when `thr...</li>
<li><a
href="f6a7abff1f"><code>f6a7abf</code></a>
[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li><a
href="fbc5206c25"><code>fbc5206</code></a>
[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max
index; remove e...</li>
<li><a
href="1b9a8b4e78"><code>1b9a8b4</code></a>
[actions] fix rebase workflow permissions</li>
<li><a
href="2a35775614"><code>2a35775</code></a>
[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
# ci: enhance stale issue/PR workflow
- Split stale workflow into marking and closing jobs
- Add dry-run mode input and environment variables
- Improve configuration for timing, messages, and operations per run
## Motivation and Context
To mark and close stale issues/PRs automatically
## How it works
The automations.yml workflow automates the lifecycle of inactive issues
and pull requests using a two-stage process. It is scheduled to run
daily at 2:00 AM UTC and supports manual execution with a dry-run
option.
### 1. Marking Phase (mark-stale job)
This job identifies inactive items and labels them as stale without
closing them.
- Criteria: Any issue or PR with no activity for 30 days.
- Action: Adds the stale label and posts a notification comment.
- Exemptions:
- Draft PRs are ignored.
- Issues labeled with awaiting-approval or work-in-progress are ignored.
- Recovery: If a contributor updates the item, the stale label is
automatically removed.
- Safety: This job is explicitly configured never to close items
(days-before-*-close: -1).
### 2. Closing Phase (close-stale job)
This job handles the final closure of items that have remained inactive
after being marked.
- Criteria: Only targets items that already have the stale label and
have seen no further activity for 15 days.
- Action: Closes the issue or PR and posts a final closure message.
- Safety: This job is explicitly configured never to mark new items
(days-before-*-stale: -1).
### Global Configuration
- Dry Run: Controlled by the DRY_RUN variable. When true, the bot logs
planned actions in the workflow output but does not actually apply
labels, post comments, or close items.
- Throttling: Processes up to 100 items per run to avoid hitting GitHub
API rate limits.
- Permissions: Requires write access to issues and pull requests to
perform its actions.
## How Has This Been Tested?
[Manually tested on
CI](https://github.com/modelcontextprotocol/kotlin-sdk/actions/runs/21984701285)
with dry run
## Breaking Changes
No
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [x] Workflow update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
## refactor: Introduce AbstractClientTransport and simplify client
transport lifecycle
This PR unifies state management logic across client transports, except
for the websocket transport, as it needs more refactoring first and is
not the primary transport.
- Introduce `AbstractClientTransport` as base class for other client
transports.
- Migrate to `ClientTransportState` states with state machine,
streamline state management.
- Ensure proper cleanup and error handling consistency across transport
implementations.
- Add unit tests to validate `AbstractClientTransport` behavior and
state transitions.
- Update related documentation and API contract.
- Make sure `onClose` callback is called at most once
- fix
[StreamableHttpClientTransportTest.kt](https://github.com/modelcontextprotocol/kotlin-sdk/pull/516/changes#diff-b9fe8891d08a492448a7ed2dc782151c6a915ae1403a4d70c2034c6062c84cb5)
to throw `McpException` on connect when received invalid Json
## Motivation and Context
Unify lifecycle handling and eliminate duplication in client Transport
implementations.
## How Has This Been Tested?
Unit test, regression tests
## Breaking Changes
- `onClose` callback is now called only once
- send(...) will throw McpException with message "Transport is not
ready" when `ClientTransportState != Operational`
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] Refactoring
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
See #517
## Motivation and Context
Adds Ktor extensions for streaming data over the server-side HTTP
transport
## How Has This Been Tested?
Integration test
## Breaking Changes
-
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
# docs: Update AGENTS.md
- Introduce CLAUDE.md symlink to AGENTS.md
- Enhance AGENTS.md with updated test setup, coding standards, and
module-specific practices
## Motivation and Context
Motivation: Improve consistency, readability, and maintainability of
code contributions across AI agents and developers.
## Breaking Changes
No
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Verified
<img width="584" height="225" alt="image"
src="https://github.com/user-attachments/assets/591202a3-56aa-4901-ad5d-9e2d4b9f0013"
/>
(I have other files locally, but AGENTS.md is known to Claude)
# fix(test): Refactor flaky StdioClientTransport tests to use real stdin
pipes
- Replace mock-based stdin with real input/output pipes for better
parity with actual usage.
- Ensure proper cleanup of resources (stdin and stdout pipes).
- Improve test stability by migrating from `runTest` to `runBlocking`
for real-time I/O operations.
## Motivation and Context
StdioClientTransportTest is flaky.
## How Has This Been Tested?
Unit test
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
#162
## Motivation and Context
- update readme
- add more snippets
- add knit
## How Has This Been Tested?
knit on CI
## Breaking Changes
None
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
---------
Co-authored-by: devcrocod <devcrocod@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Bumps
[com.vanniktech:gradle-maven-publish-plugin](https://github.com/vanniktech/gradle-maven-publish-plugin)
from 0.35.0 to 0.36.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/releases">com.vanniktech:gradle-maven-publish-plugin's
releases</a>.</em></p>
<blockquote>
<h2>0.36.0</h2>
<p><strong>BREAKING</strong></p>
<ul>
<li>Updated minimum supported JDK, Gradle, Android Gradle Plugin and
Kotlin versions.</li>
<li>Removed support for Dokka v1, it's now required to use Dokka in v2
mode.</li>
<li>Mark <code>DirectorySignatureType</code> internal.</li>
</ul>
<p><strong>Behavior changes</strong></p>
<ul>
<li><code>validateDeployment</code> now has the
<code>DeploymentValidation</code> enum as type instead of being a
boolean. The default
is now to just wait for the <code>VALIDATED</code> state. The previous
behavior can be achieved by setting it to <code>PUBLISHED</code>.
<code>NONE</code> can be used for disabling the validation
completely.</li>
<li>When calling <code>configure(...)</code> manually to configure what
to publish and not passing <code>javadocJar</code> explicity,
the plugin now defaults to publishing an empty javadoc jar.</li>
</ul>
<p><strong>Features</strong></p>
<ul>
<li>Android projects now support using Dokka for javadoc creation, this
will happen automatically
when using the default options and the Dokka plugin is applied to the
project.</li>
<li>Added consistent <code>JavadocJar</code> and <code>SourcesJar</code>
options to <code>configureBasedOnAppliedPlugins</code> and to all
applicable project types that can be passed to <code>configure</code>.
The previous <code>Boolean</code> based versions have
been deprecated.</li>
<li>When enabling Maven Central publishing through the DSL, the
<code>mavenCentralDeploymentValidation</code> and
<code>mavenCentralAutomaticPublishing</code> are used for the default
values of the 2 parameters when they are not passed
explicitly. This allows to more easily override them in certain
environments.</li>
<li>When isolated projects is enabled the module/project specific
<code>gradle.properties</code> files are now considered in
the same way they are when isolated projects is disabled.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Better error message when Maven Central credentials are
missing.</li>
</ul>
<h4>Minimum supported versions</h4>
<ul>
<li>JDK 17</li>
<li>Gradle 9.0.0</li>
<li>Android Gradle Plugin 8.13.0</li>
<li>Kotlin Gradle Plugin 2.2.0</li>
</ul>
<h4>Compatibility tested up to</h4>
<ul>
<li>JDK 25</li>
<li>Gradle 9.3.0</li>
<li>Gradle 9.4.0-milestone-4</li>
<li>Android Gradle Plugin 8.13.2</li>
<li>Android Gradle Plugin 9.0.0</li>
<li>Android Gradle Plugin 9.1.0-alpha05</li>
<li>Kotlin Gradle Plugin 2.3.0</li>
<li>Kotlin Gradle Plugin 2.3.20-Beta1</li>
</ul>
<h2>0.36.0-rc2</h2>
<p><strong>BREAKING</strong></p>
<ul>
<li>Updated minimum supported JDK, Gradle, Android Gradle Plugin and
Kotlin versions.</li>
<li>Removed support for Dokka v1, it's now required to use Dokka in v2
mode.</li>
<li>Mark <code>DirectorySignatureType</code> internal.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/blob/main/CHANGELOG.md">com.vanniktech:gradle-maven-publish-plugin's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/releases/tag/0.36.0">0.36.0</a>
<em>(2026-01-13)</em></h2>
<p><strong>BREAKING</strong></p>
<ul>
<li>Updated minimum supported JDK, Gradle, Android Gradle Plugin and
Kotlin versions.</li>
<li>Removed support for Dokka v1, it's now required to use Dokka in v2
mode.</li>
<li>Mark <code>DirectorySignatureType</code> internal.</li>
</ul>
<p><strong>Behavior changes</strong></p>
<ul>
<li><code>validateDeployment</code> now has the
<code>DeploymentValidation</code> enum as type instead of being a
boolean. The default
is now to just wait for the <code>VALIDATED</code> state. The previous
behavior can be achieved by setting it to <code>PUBLISHED</code>.
<code>NONE</code> can be used for disabling the validation
completely.</li>
<li>When calling <code>configure(...)</code> manually to configure what
to publish and not passing <code>javadocJar</code> explicity,
the plugin now defaults to publishing an empty javadoc jar.</li>
</ul>
<p><strong>Features</strong></p>
<ul>
<li>Android projects now support using Dokka for javadoc creation, this
will happen automatically
when using the default options and the Dokka plugin is applied to the
project.</li>
<li>Added consistent <code>JavadocJar</code> and <code>SourcesJar</code>
options to <code>configureBasedOnAppliedPlugins</code> and to all
applicable project types that can be passed to <code>configure</code>.
The previous <code>Boolean</code> based versions have
been deprecated.</li>
<li>When enabling Maven Central publishing through the DSL, the
<code>mavenCentralDeploymentValidation</code> and
<code>mavenCentralAutomaticPublishing</code> are used for the default
values of the 2 parameters when they are not passed
explicitly. This allows to more easily override them in certain
environments.</li>
<li>When isolated projects is enabled the module/project specific
<code>gradle.properties</code> files are now considered in
the same way they are when isolated projects is disabled.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Better error message when Maven Central credentials are
missing.</li>
</ul>
<h4>Minimum supported versions</h4>
<ul>
<li>JDK 17</li>
<li>Gradle 9.0.0</li>
<li>Android Gradle Plugin 8.13.0</li>
<li>Kotlin Gradle Plugin 2.2.0</li>
</ul>
<h4>Compatibility tested up to</h4>
<ul>
<li>JDK 25</li>
<li>Gradle 9.3.0</li>
<li>Gradle 9.4.0-milestone-4</li>
<li>Android Gradle Plugin 8.13.2</li>
<li>Android Gradle Plugin 9.0.0</li>
<li>Android Gradle Plugin 9.1.0-alpha05</li>
<li>Kotlin Gradle Plugin 2.3.0</li>
<li>Kotlin Gradle Plugin 2.3.20-Beta1</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0a5fa58778"><code>0a5fa58</code></a>
rc2 and wait for published</li>
<li><a
href="695e18a932"><code>695e18a</code></a>
rc1</li>
<li><a
href="f92dc3a37b"><code>f92dc3a</code></a>
Changelog for 0.36.0</li>
<li><a
href="bddd1e6d7b"><code>bddd1e6</code></a>
Update dependency org.jetbrains.kotlin.jvm to v2.3.20-Beta1 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1289">#1289</a>)</li>
<li><a
href="22f90b2df5"><code>22f90b2</code></a>
Update Gradle to v9.3.0 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1301">#1301</a>)</li>
<li><a
href="d7d5f34301"><code>d7d5f34</code></a>
Update android.gradle to v9 (major) (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1298">#1298</a>)</li>
<li><a
href="3d262a6a47"><code>3d262a6</code></a>
Update dependency com.android.library to v9.1.0-alpha05 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1300">#1300</a>)</li>
<li><a
href="a8573eda99"><code>a8573ed</code></a>
Update plugin com.gradle.develocity to v4.3.1 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1299">#1299</a>)</li>
<li><a
href="ee0f2e3bba"><code>ee0f2e3</code></a>
Fix typo in default <code>DeploymentValidation</code> and correct
documentation (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1296">#1296</a>)</li>
<li><a
href="783599f03e"><code>783599f</code></a>
Update dependency com.android.library to v9.0.0 (<a
href="https://redirect.github.com/vanniktech/gradle-maven-publish-plugin/issues/1297">#1297</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vanniktech/gradle-maven-publish-plugin/compare/0.35.0...0.36.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the
/integration-test/src/jvmTest/typescript directory:
[hono](https://github.com/honojs/hono).
Updates `hono` from 4.11.4 to 4.11.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.11.7</h2>
<h1>Security Release</h1>
<p>This release includes security fixes for multiple vulnerabilities in
Hono and related middleware. We recommend upgrading if you are using any
of the affected components.</p>
<h2>Components</h2>
<h3>IP Restriction Middleware</h3>
<p>Fixed an IPv4 address validation bypass that could allow IP-based
access control to be bypassed under certain configurations.</p>
<h3>Cache Middleware</h3>
<p>Fixed an issue where responses marked with <code>Cache-Control:
private</code> or <code>no-store</code> could be cached, potentially
leading to information disclosure on some runtimes.</p>
<h3>Serve Static Middleware (Cloudflare Workers adapter)</h3>
<p>Fixed an issue that could allow unintended access to internal asset
keys when serving static files with user-controlled paths.</p>
<h3>hono/jsx <code>ErrorBoundary</code></h3>
<p>Fixed a reflected Cross-Site Scripting (XSS) issue in the
<code>ErrorBoundary</code> component that could occur when untrusted
strings were rendered without proper escaping.</p>
<h2>Recommendation</h2>
<p>Users are encouraged to upgrade to this release, especially if
they:</p>
<ul>
<li>Use IP Restriction Middleware</li>
<li>Use Cache Middleware on Deno, Bun, or Node.js</li>
<li>Use Serve Static Middleware with user-controlled paths on Cloudflare
Workers</li>
<li>Render untrusted data inside <code>ErrorBoundary</code>
components</li>
</ul>
<h2>Security Advisories & CVEs</h2>
<ul>
<li>
<p><strong>IP Restriction Middleware – IPv4 address validation
bypass</strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh">https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh</a></li>
<li>CVE: CVE-2026-24398</li>
</ul>
</li>
<li>
<p><strong>Cache Middleware ignores <code>Cache-Control:
private</code></strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4">https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4</a></li>
<li>CVE: CVE-2026-24472</li>
</ul>
</li>
<li>
<p><strong>Serve Static Middleware (Cloudflare Workers adapter) –
Arbitrary key read</strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p">https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p</a></li>
<li>CVE: CVE-2026-24473</li>
</ul>
</li>
<li>
<p><strong>hono/jsx <code>ErrorBoundary</code> – Cross-Site Scripting
(XSS)</strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5">https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5</a></li>
<li>CVE: Pending</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f7d272abe1"><code>f7d272a</code></a>
4.11.7</li>
<li><a
href="2cf60046d7"><code>2cf6004</code></a>
Merge commit from fork</li>
<li><a
href="cf9a78db4d"><code>cf9a78d</code></a>
Merge commit from fork</li>
<li><a
href="edbf6eea8e"><code>edbf6ee</code></a>
Merge commit from fork</li>
<li><a
href="12c511745b"><code>12c5117</code></a>
Merge commit from fork</li>
<li><a
href="7343487e62"><code>7343487</code></a>
4.11.6</li>
<li><a
href="b6e5a97cd4"><code>b6e5a97</code></a>
feat(bun): export getBunServer (<a
href="https://redirect.github.com/honojs/hono/issues/4626">#4626</a>)</li>
<li><a
href="2a9cd953b6"><code>2a9cd95</code></a>
fix(sse): handle <code>\r</code> and <code>\r\n</code> line endings in
writeSSE (<a
href="https://redirect.github.com/honojs/hono/issues/4644">#4644</a>)</li>
<li><a
href="8078bbf759"><code>8078bbf</code></a>
docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant (<a
href="https://redirect.github.com/honojs/hono/issues/4630">#4630</a>)</li>
<li><a
href="a5be555b31"><code>a5be555</code></a>
refactor: use <code>unique symbol</code> for more accurate typing. (<a
href="https://redirect.github.com/honojs/hono/issues/4651">#4651</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.11.4...v4.11.7">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `kotest` from 6.1.1 to 6.1.2.
Updates `io.kotest:kotest-assertions-core` from 6.1.1 to 6.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kotest/kotest/releases">io.kotest:kotest-assertions-core's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Improve JS execution to use common spec executor and fix after
project listeners by <a
href="https://github.com/sksamuel"><code>@sksamuel</code></a> in <a
href="https://redirect.github.com/kotest/kotest/pull/5609">kotest/kotest#5609</a></li>
<li>Add test to confirm async calls in JS SpecExtension.intercept by <a
href="https://github.com/sksamuel"><code>@sksamuel</code></a> in <a
href="https://redirect.github.com/kotest/kotest/pull/5610">kotest/kotest#5610</a></li>
<li>Add option to the gradle plugin to always rerun tests by <a
href="https://github.com/sksamuel"><code>@sksamuel</code></a> in <a
href="https://redirect.github.com/kotest/kotest/pull/5636">kotest/kotest#5636</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kotest/kotest/compare/6.1.2...v6.1.2">https://github.com/kotest/kotest/compare/6.1.2...v6.1.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cbd905312e"><code>cbd9053</code></a>
Run superclasses on EDT for test explorer service (<a
href="https://redirect.github.com/kotest/kotest/issues/5633">#5633</a>)</li>
<li><a
href="d66e03ed84"><code>d66e03e</code></a>
Restore forEachAsClue.</li>
<li><a
href="028be67052"><code>028be67</code></a>
Migrate JUnit 4 runner to common source sets for JVM and Android
code.</li>
<li><a
href="b6ff74bf3f"><code>b6ff74b</code></a>
Add Android specific JUnit4 implementation with filter (<a
href="https://redirect.github.com/kotest/kotest/issues/5632">#5632</a>)</li>
<li><a
href="a12e3e0c7c"><code>a12e3e0</code></a>
add similarity to containOnly (<a
href="https://redirect.github.com/kotest/kotest/issues/5626">#5626</a>)
(<a
href="https://redirect.github.com/kotest/kotest/issues/5627">#5627</a>)</li>
<li><a
href="79d76734d2"><code>79d7673</code></a>
Add JUnitTestEngineListener tests and update runBlocking context for
single-t...</li>
<li><a
href="34acaeb1ba"><code>34acaeb</code></a>
add-similarity-to-startWith-endWith (<a
href="https://redirect.github.com/kotest/kotest/issues/5629">#5629</a>)</li>
<li><a
href="aef140ccfc"><code>aef140c</code></a>
Update support for nested JUnit4 tests used by Android (<a
href="https://redirect.github.com/kotest/kotest/issues/5630">#5630</a>)</li>
<li><a
href="fe90631dd8"><code>fe90631</code></a>
Setup intellij plugin for 253 and Android development (<a
href="https://redirect.github.com/kotest/kotest/issues/5623">#5623</a>)</li>
<li><a
href="d9f3757261"><code>d9f3757</code></a>
Add missing docker compose file for test</li>
<li>Additional commits viewable in <a
href="https://github.com/kotest/kotest/compare/6.1.1...6.1.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `io.kotest:kotest-assertions-json` from 6.1.1 to 6.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kotest/kotest/releases">io.kotest:kotest-assertions-json's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Improve JS execution to use common spec executor and fix after
project listeners by <a
href="https://github.com/sksamuel"><code>@sksamuel</code></a> in <a
href="https://redirect.github.com/kotest/kotest/pull/5609">kotest/kotest#5609</a></li>
<li>Add test to confirm async calls in JS SpecExtension.intercept by <a
href="https://github.com/sksamuel"><code>@sksamuel</code></a> in <a
href="https://redirect.github.com/kotest/kotest/pull/5610">kotest/kotest#5610</a></li>
<li>Add option to the gradle plugin to always rerun tests by <a
href="https://github.com/sksamuel"><code>@sksamuel</code></a> in <a
href="https://redirect.github.com/kotest/kotest/pull/5636">kotest/kotest#5636</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kotest/kotest/compare/6.1.2...v6.1.2">https://github.com/kotest/kotest/compare/6.1.2...v6.1.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cbd905312e"><code>cbd9053</code></a>
Run superclasses on EDT for test explorer service (<a
href="https://redirect.github.com/kotest/kotest/issues/5633">#5633</a>)</li>
<li><a
href="d66e03ed84"><code>d66e03e</code></a>
Restore forEachAsClue.</li>
<li><a
href="028be67052"><code>028be67</code></a>
Migrate JUnit 4 runner to common source sets for JVM and Android
code.</li>
<li><a
href="b6ff74bf3f"><code>b6ff74b</code></a>
Add Android specific JUnit4 implementation with filter (<a
href="https://redirect.github.com/kotest/kotest/issues/5632">#5632</a>)</li>
<li><a
href="a12e3e0c7c"><code>a12e3e0</code></a>
add similarity to containOnly (<a
href="https://redirect.github.com/kotest/kotest/issues/5626">#5626</a>)
(<a
href="https://redirect.github.com/kotest/kotest/issues/5627">#5627</a>)</li>
<li><a
href="79d76734d2"><code>79d7673</code></a>
Add JUnitTestEngineListener tests and update runBlocking context for
single-t...</li>
<li><a
href="34acaeb1ba"><code>34acaeb</code></a>
add-similarity-to-startWith-endWith (<a
href="https://redirect.github.com/kotest/kotest/issues/5629">#5629</a>)</li>
<li><a
href="aef140ccfc"><code>aef140c</code></a>
Update support for nested JUnit4 tests used by Android (<a
href="https://redirect.github.com/kotest/kotest/issues/5630">#5630</a>)</li>
<li><a
href="fe90631dd8"><code>fe90631</code></a>
Setup intellij plugin for 253 and Android development (<a
href="https://redirect.github.com/kotest/kotest/issues/5623">#5623</a>)</li>
<li><a
href="d9f3757261"><code>d9f3757</code></a>
Add missing docker compose file for test</li>
<li>Additional commits viewable in <a
href="https://github.com/kotest/kotest/compare/6.1.1...6.1.2">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
Add integration tests for Prompts, Resources, and Tools over Streamable
HTTP transport as outlined in #183.
## Changes
- [x] Infrastructure: Enable `STREAMABLE_HTTP` transport in test base
- [x] Prompts: Add functional integration tests
- [x] Resources: Add functional integration tests
- [x] Tools: Add functional integration tests
Related to #332
---------
Co-authored-by: Konstantin Pavlov <1517853+kpavlov@users.noreply.github.com>
- increase the deprecation level
- remove tests that use deprecated objects with deprecation level =
error
## Motivation and Context
deprecation lifecycle
## How Has This Been Tested?
-
## Breaking Changes
-
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
- generate detekt config
- enable several rules
- disable ktlint backing property check
## Motivation and Context
Centralized control of detekt rules. Using detekt 2 configuration
## How Has This Been Tested?
locally
## Breaking Changes
-
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
Jakub Amanowicz
Konstantin Pavlov
dependabot[bot]
Ryan Nett
Anastasiia Zarechneva
Den Delimarsky
Ilia Brovarnik
Pavel Gorgulov
johny