build(deps): bump mcp from 0.22.0 to 0.24.0 in /docs

Merged
DE
4mo ago
+1-1

Bumps mcp from 0.22.0 to 0.24.0.

Release notes

Sourced from mcp's releases.

v0.24.0

Added

  • Support SSE reconnection per SEP-1699 in the HTTP client transport (#426)
  • Validate the RFC 9207 iss authorization response parameter per SEP-2468 (#431)
  • Support private_key_jwt client authentication for the client_credentials grant (#432)
  • Recognize multi round-trip input_required results per SEP-2322 (#433)
  • Add opt-in ttlMs / cacheScope cache hints to List and Read results per SEP-2549 (#436)
  • Add server/discover and stateless lifecycle error codes per SEP-2575 (#438)
  • Associate server-to-client requests with the originating client request per SEP-2260 (#440)
  • Add server-side MCP Apps helpers per SEP-1865 (#441)
  • Support client-side elicitation with SEP-1034 schema defaults (#443)
  • Support class-based Resource and ResourceTemplate definitions (#447)

Changed

  • Bind stored client credentials to the authorization server issuer per SEP-2352 (#439)

Fixed

  • Handle non-object JSON-RPC messages without raising (#448)
  • Perform SSE stream writes outside the session mutex (#449)
  • Validate required params for initialize and resources/subscribe (#451)

v0.23.0

Added

  • Add a session-ownership hook to StreamableHTTPTransport

Changed

  • Require calling MCP::Client#connect before sending requests on stdio transport (#427)

Deprecated

  • Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)

Fixed

  • Fix an incorrect result: null response to an id-bearing notification message (#435)
  • Validate Host and Origin headers to prevent DNS rebinding per MCP 2025-11-25
  • Bound stateful session retention to prevent an initialize-flood DoS
  • Bound stdio frame reads with max_line_bytes
  • Bound request body and frame reads to prevent memory-exhaustion DoS
Changelog

Sourced from mcp's changelog.

[0.24.0] - 2026-07-12

Added

  • Support SSE reconnection per SEP-1699 in the HTTP client transport (#426)
  • Validate the RFC 9207 iss authorization response parameter per SEP-2468 (#431)
  • Support private_key_jwt client authentication for the client_credentials grant (#432)
  • Recognize multi round-trip input_required results per SEP-2322 (#433)
  • Add opt-in ttlMs / cacheScope cache hints to List and Read results per SEP-2549 (#436)
  • Add server/discover and stateless lifecycle error codes per SEP-2575 (#438)
  • Associate server-to-client requests with the originating client request per SEP-2260 (#440)
  • Add server-side MCP Apps helpers per SEP-1865 (#441)
  • Support client-side elicitation with SEP-1034 schema defaults (#443)
  • Support class-based Resource and ResourceTemplate definitions (#447)

Changed

  • Bind stored client credentials to the authorization server issuer per SEP-2352 (#439)

Fixed

  • Handle non-object JSON-RPC messages without raising (#448)
  • Perform SSE stream writes outside the session mutex (#449)
  • Validate required params for initialize and resources/subscribe (#451)

[0.23.0] - 2026-07-07

Added

  • Add a session-ownership hook to StreamableHTTPTransport

Changed

  • Require calling MCP::Client#connect before sending requests on stdio transport (#427)

Deprecated

  • Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)

Fixed

  • Fix an incorrect result: null response to an id-bearing notification message (#435)
  • Validate Host and Origin headers to prevent DNS rebinding per MCP 2025-11-25
  • Bound stateful session retention to prevent an initialize-flood DoS
  • Bound stdio frame reads with max_line_bytes
  • Bound request body and frame reads to prevent memory-exhaustion DoS
Commits
  • e85f6d0 Merge pull request #453 from koic/release_0_24_0
  • 1d8db69 Release 0.24.0
  • be59660 Merge pull request #443 from koic/elicitation_sep1034_defaults
  • 5f9c84d Merge pull request #441 from koic/mcp_apps
  • a793dde Merge pull request #440 from koic/mcp_2026_07_28_spec_associate_server_requests
  • e1fabe3 Merge pull request #439 from koic/issuer_bound_client_credentials
  • c43ea6e Merge pull request #433 from koic/mrtr_result_type
  • 562afdf Merge pull request #432 from koic/client_credentials_jwt
  • 3d442d0 Merge pull request #448 from koic/handle_non_object_json_rpc_messages
  • 8aae052 Merge pull request #431 from koic/iss_parameter_validation
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Upgrade mcp in /docs from 0.22.0 to 0.24.0 to pick up protocol updates, security hardening, and fixes. Improves connection reliability and keeps docs aligned with the current SDK.

  • Dependencies
    • Bump mcp 0.22.0 → 0.24.0.
    • Notable changes: SSE reconnection for HTTP, RFC 9207 iss validation and issuer-bound credentials, and JSON‑RPC handling fixes.