Bump mcp from 1.1.0 to 1.5.0

[dependabot]

Bumps mcp from 1.1.0 to 1.5.0.

Release notes

Sourced from mcp's releases.

v1.5.0

This release makes the client answer a server's ping with the empty result the specification requires. Earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, so a server that checks liveness dropped their long-lived sessions. On the OAuth side, the embedding application can refuse an authorization request through authorization_request_validator, and stored tokens are refreshed only against the authorization server that issued them: when the server named for a session differs, the client reauthorizes instead of refreshing, and the validator sees the newly named server. Tokens stored by earlier releases carry no issuer and keep refreshing.

Added

• Add authorization_request_validator to let the embedding application refuse an authorization request (#539)

Fixed

• Answer server-to-client pings in the client (#541)

v1.4.0

This release repairs the subscriptions/listen stream. A host that buffers its responses, the documented Rails controller pattern among them, can decline the method with serve_subscriptions_listen: false instead of answering a modern client with a streaming body it cannot render, and the stream's ordering guarantees are enforced: no notification reaches a client before the acknowledgement, and none follows the graceful closing result.

Added

• Add serve_subscriptions_listen: for hosts that cannot hold an SSE stream open (#533)

Fixed

• Deliver subscriptions/listen notifications only after the acknowledgement (#532)
• Serialize subscriptions/listen writes so the graceful result is the final message (#535)

v1.3.0

User-facing documentation now lives on the documentation site at https://ruby.sdk.modelcontextprotocol.io, and README.md keeps the quick start. Two entries under "Changed" reject traffic that earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md.

Added

• Add a resources_list_handler for context-dependent resource lists (#509)
• Pass a handler-returned _meta through the subscribe result (#510)

Changed

• Bound OAuth response bodies in the client (#520)
• Reject duplicate in-flight JSON-RPC request ids (#521)
• Move the documentation from README.md to the documentation site (#523)

v1.2.0

This release completes the SEP-2575 stateless lifecycle of the 2026-07-28 specification, together with the SEP-2322, SEP-2549, and SEP-2243 features that revision builds on. Several entries under "Changed" are incompatible with 1.1.0 and ship in a minor release under the spec-conformance and security exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md.

Added

• Handle the SEP-2575 modern request envelope in the server core (#475)
• Serve both lifecycle eras over stdio with an era lock per SEP-2575 (#478)
• Serve the sessionless modern path over Streamable HTTP per SEP-2575 (#479)
• Finalize server/discover and add client modern lifecycle support per SEP-2575 (#480)
• Let handlers return multi round-trip input_required results per SEP-2322 (#481)
• Add MCP::Elicitation::EnumSchema builders per SEP-1330 (#482)
• Stamp the required resultType on modern results per SEP-2322 (#487)
• Enforce the modern lifecycle admission rules per SEP-2575 (#489)

... (truncated)

Changelog

Sourced from mcp's changelog.

[1.5.0] - 2026-09-05

This release makes the client answer a server's ping with the empty result the specification requires. Earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, so a server that checks liveness dropped their long-lived sessions. On the OAuth side, the embedding application can refuse an authorization request through authorization_request_validator, and stored tokens are refreshed only against the authorization server that issued them: when the server named for a session differs, the client reauthorizes instead of refreshing, and the validator sees the newly named server. Tokens stored by earlier releases carry no issuer and keep refreshing.

Added

• Add authorization_request_validator to let the embedding application refuse an authorization request (#539)

Fixed

• Answer server-to-client pings in the client (#541)

[1.4.0] - 2026-08-28

This release repairs the subscriptions/listen stream. A host that buffers its responses, the documented Rails controller pattern among them, can decline the method with serve_subscriptions_listen: false instead of answering a modern client with a streaming body it cannot render, and the stream's ordering guarantees are enforced: no notification reaches a client before the acknowledgement, and none follows the graceful closing result.

Added

• Add serve_subscriptions_listen: for hosts that cannot hold an SSE stream open (#533)

Fixed

• Deliver subscriptions/listen notifications only after the acknowledgement (#532)
• Serialize subscriptions/listen writes so the graceful result is the final message (#535)

[1.3.0] - 2026-08-22

User-facing documentation now lives on the documentation site at https://ruby.sdk.modelcontextprotocol.io, and README.md keeps the quick start. Two entries under "Changed" reject traffic that earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md.

Added

• Add a resources_list_handler for context-dependent resource lists (#509)
• Pass a handler-returned _meta through the subscribe result (#510)

Changed

• Bound OAuth response bodies in the client (#520)
• Reject duplicate in-flight JSON-RPC request ids (#521)

... (truncated)

Commits

• 8a24e50 Merge pull request #543 from koic/release_1_5_0
• 33525d6 Release 1.5.0
• f706cc8 Merge pull request #542 from koic/fix_flaky_listen_keepalive_thread_assertion
• 6d272df Merge pull request #541 from koic/respond_to_server_pings_in_the_client
• eeab784 Merge pull request #539 from koic/add_authorization_request_validator
• 09c3103 Fix the flaky thread count assertion in the listen keepalive test
• 088f4b9 Answer server-to-client pings in the client
• 6b1704f Merge pull request #540 from koic/mark_deprecated_features_on_the_server_over...
• 6f0b854 [Doc] Mark the deprecated features on the server overview
• 09d4bf4 Let the embedding application refuse an authorization request
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)