From 28ec26988b0f2a0af7ef3dd28ffac9d40ff37f8e Mon Sep 17 00:00:00 2001 From: Koichi ITO Date: Fri, 16 Oct 2026 00:40:47 +0900 Subject: [PATCH] Release 1.8.0 This release adds OAuth 2.1 resource server support to `StreamableHTTPTransport`: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in VERSIONING.md: a server whose responses lack `"jsonrpc": "2.0"` has to send the member, since there is no opt-out. --- CHANGELOG.md | 28 ++++++++++++++++++++++++++++ lib/mcp/version.rb | 2 +- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 91faa0fa..c0b1f937 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.8.0] - 2026-10-16 + +This release adds OAuth 2.1 resource server support to `StreamableHTTPTransport`: bearer tokens are verified +by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 +challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays +with an external authorization server. +The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier +releases accepted and ships in a minor release under the exceptions described in [VERSIONING.md](VERSIONING.md): +a server whose responses lack `"jsonrpc": "2.0"` has to send the member, since there is no opt-out. + +### Added + +- Add OAuth 2.1 resource server support (#545) +- Add a scope selector for OAuth authorization-code clients (#579) + +### Changed + +- Reject server messages that are not JSON-RPC 2.0 in the client transports (#590) + +### Fixed + +- Redact the `Authorization` header from the errors the HTTP transport retains (#591) +- Close a refused SSE stream outside the registry lock (#592) +- Let the session reaper finish before the transport closes (#593) +- Bound the `subscriptions/listen` teardown on transport close (#595) +- Close a failed `subscriptions/listen` stream only from the path that removed its entry (#596) +- Accept any 2xx acknowledgement of a notification in the HTTP client (#600) + ## [1.7.0] - 2026-10-05 This release lets a web application finish the OAuth authorization in the request that receives the redirect, diff --git a/lib/mcp/version.rb b/lib/mcp/version.rb index 7437a294..cd4c56c7 100644 --- a/lib/mcp/version.rb +++ b/lib/mcp/version.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true module MCP - VERSION = "1.7.0" + VERSION = "1.8.0" end