build(deps): bump io.modelcontextprotocol.sdk:mcp from 0.17.0 to 2.0.1

[dependabot]

Bumps io.modelcontextprotocol.sdk:mcp from 0.17.0 to 2.0.1.

Release notes

Sourced from io.modelcontextprotocol.sdk:mcp's releases.

v2.0.1

What's Changed

• Upgrade conformance suite to 0.1.16, Spring AI conformance to 2.0.0 GA by @​Kehrlann in modelcontextprotocol/java-sdk#1032
• Return empty completion when no handler matches a valid ref by @​jstar0 in modelcontextprotocol/java-sdk#996
• Close response after sending error in McpStreamableServerSession#responseStream by @​Kehrlann in modelcontextprotocol/java-sdk#1041
• Fix error behavior on unregistered handlers in stateless server handler by @​maff in modelcontextprotocol/java-sdk#800
• Remove invalid WARN message for missing notification handler in stateless servers by @​bperhaps in modelcontextprotocol/java-sdk#835
• Fix SSE event classification to follow spec for missing event field by @​iaJingda in modelcontextprotocol/java-sdk#913
• fix: stop pagination on empty cursors by @​nanookclaw in modelcontextprotocol/java-sdk#954
• fix McpTransportContext.create() mutability issue and add tests by @​iuliiasobolevska in modelcontextprotocol/java-sdk#1076
• Bound HTTP server and client reads by @​Kehrlann in modelcontextprotocol/java-sdk#1102
• Bound STDIO server and client reads by @​Kehrlann in modelcontextprotocol/java-sdk#1103

Depedency updates

• Bump json-schema-validator to 2.0.4 / 3.0.6, jackson to 2.21.1 / 3.1.4 by @​joaodinissf in modelcontextprotocol/java-sdk#1058

New Contributors

• @​jstar0 made their first contribution in modelcontextprotocol/java-sdk#996
• @​ammbra made their first contribution in modelcontextprotocol/java-sdk#1044
• @​maff made their first contribution in modelcontextprotocol/java-sdk#800
• @​bperhaps made their first contribution in modelcontextprotocol/java-sdk#835
• @​iaJingda made their first contribution in modelcontextprotocol/java-sdk#913
• @​nanookclaw made their first contribution in modelcontextprotocol/java-sdk#954
• @​iuliiasobolevska made their first contribution in modelcontextprotocol/java-sdk#1076

Full Changelog: modelcontextprotocol/java-sdk@v2.0.0...v2.0.1

v2.0.0

MCP Java SDK 2.0.0 🎉

We're thrilled to announce the General Availability of the MCP Java SDK 2.0.0 — the first major release since 1.x and the culmination of three milestones (M1, M2, M3) and a release candidate (RC1). It tracks the latest 2025-11-25 MCP specification and lays the groundwork for everything that comes next. Huge thanks to everyone who contributed, tested the milestones, and filed feedback along the way! ❤️

Upgrading from 1.x? See the v2 migration guide and the updated documentation (#1024) for a step-by-step walkthrough of the breaking changes below.

Highlights

• A new JSON compatibility foundation for consistent forward/backward wire compatibility as the protocol evolves.
• Spec-accurate schema with enforced required fields and lenient wire deserialization.
• End-to-end validation of tool inputs and embedded JSON Schema documents (2020-12).
• Richer elicitation: client-side schema defaults, URL elicitation, and form-based elicitation schemas.
• Icons & metadata support (SEP-973) across the API.
• Streamable HTTP first: SSE transports are now deprecated in favor of Streamable HTTP.
• Cleaner, quieter logging with unified configuration and saner default levels.

⚠️ Breaking Changes

• feat!: consistent JSON forward/backward compatibility — the 2.0 foundation by @​chemicL in modelcontextprotocol/java-sdk#927

... (truncated)

Changelog

Sourced from io.modelcontextprotocol.sdk:mcp's changelog.

2.0.1 — 2026-08-19

• Bound STDIO and HTTP client/server reads to a configurable maximum size

Full notes: v2.0.1 release

2.0.0 — 2026-06-11

First major release since 1.x, tracking the 2025-11-25 MCP specification. Upgrading from 1.x? See the v2 migration guide.

• New JSON compatibility foundation for forward/backward wire compatibility, with pluggable Jackson 2 / Jackson 3 serialization modules
• Spec-accurate schema: enforced required fields, lenient wire deserialization
• End-to-end validation of tool inputs and embedded JSON Schema documents (JSON Schema 2020-12, SEP-1613)
• Richer elicitation: client-side schema defaults (SEP-1034), URL elicitation (SEP-1036), form-based elicitation schemas
• Icons and metadata support (SEP-973)
• Streamable HTTP first: SSE transports deprecated in favor of Streamable HTTP
• Module restructuring: mcp-core, mcp-json-jackson2, mcp-json-jackson3, mcp-bom

Full notes: v2.0.0 release (preceded by milestones M1, M2, M3, RC1).

1.x

• 1.1.4 — 2026-08-19: bound HTTP client/server reads (backport)
• 1.1.3 / 1.0.2 — 2026-05-21: SSE client transport message-endpoint validation (backports)
• 1.1.2 — 2026-04-25
• 1.1.1 / 1.0.1 — 2026-03-27
• 1.1.0 — 2026-03-13
• 1.0.0 — 2026-02-23: first stable release; see the 1.0 migration guide

0.x

• 0.18.4 — 2026-08-19: bound HTTP client/server reads (backport)
• 0.18.3 — 2026-06-09: security fix for GHSA-hv2w-8mjj-jw22
• 0.18.0 –

... (truncated)

Commits

• c7e1cfe Release version 2.0.1
• 3477fcd Bound STDIO client reads
• 3b72eec Bound STDIO server reads
• ef037da Bound HTTP client reads
• 6a41ded Bound HTTP server reads
• 1fcb404 Clarify supported lines 2.0.x, 1.1.x, 0.18.x
• e75a8ee ignore .envrc
• 2fd159a Prepare SDK Tier 2 assessment submission
• 8ee8ccb Make McpTransportContext.metadata immutable (#1076)
• 27b9152 fix: stop pagination on empty cursors (#954)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}