Merge pull request #442 from koic/release_0_23_0

Release 0.23.0

CHANGELOG.md

@@ -7,10 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-07-07
+
+### Added
+
+- Add a session-ownership hook to `StreamableHTTPTransport`
+
+### Changed
+
+- Require calling `MCP::Client#connect` before sending requests on stdio transport (#427)
+
 ### Deprecated
 
 - Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)
 
+### Fixed
+
+- Fix an incorrect `result: null` response to an id-bearing notification message (#435)
+- Validate `Host` and `Origin` headers to prevent DNS rebinding per MCP 2025-11-25
+- Bound stateful session retention to prevent an initialize-flood DoS
+- Bound stdio frame reads with `max_line_bytes`
+- Bound request body and frame reads to prevent memory-exhaustion DoS
+
 ## [0.22.0] - 2026-06-27
 
 ### Added

lib/mcp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MCP
-  VERSION = "0.22.0"
+  VERSION = "0.23.0"
 end