Bump mcp from 1.6.1 to 1.8.0

[dependabot]

Bumps mcp from 1.6.1 to 1.8.0.

Release notes

Sourced from mcp's releases.

v1.8.0

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

v1.7.0

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

Changelog

Sourced from mcp's changelog.

[1.8.0] - 2026-10-16

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

[1.7.0] - 2026-10-05

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

... (truncated)

Commits

• 56af0c7 Merge pull request #618 from koic/release_1_8_0
• 28ec269 Release 1.8.0
• 157ab51 Merge pull request #596 from koic/close_a_failed_listen_stream_from_the_path_...
• 0019b4d Merge pull request #614 from koic/allow_the_end_to_end_host_under_dns_rebindi...
• 820b65c Allow the end-to-end test's host under DNS rebinding protection
• 9d12f51 Merge pull request #600 from koic/accept_any_2xx_acknowledgement_of_a_notific...
• 2527cba Merge pull request #597 from koic/state_the_modern_status_of_a_require_scopes...
• 243c19a Accept any 2xx acknowledgement of a notification in the HTTP client
• 7735046 Merge pull request #595 from koic/bound_the_listen_teardown_on_transport_close
• 6d40d4c Close a failed listen stream only from the path that removed its entry
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)