Bump the all-dependencies group with 1 update by dependabot[bot] · Pull Request #288 · emberstack/ES.FX

dependabot · 2026-07-29T01:12:26Z

Updated ModelContextProtocol.AspNetCore from 1.4.1 to 2.0.0.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

Default to stateless HTTP and discovery-first negotiation #1610
- HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
- Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
- Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
Deprecate Roots, Sampling, and Logging APIs #1651
- The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
- Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
Move Tasks into ModelContextProtocol.Extensions.Tasks #1693
- The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
- Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
Strengthen OAuth callback and issuer validation #1605
- AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
- OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
Emit non-object structured tool results directly #1568
- Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
- Update clients to read the value according to the advertised output schema rather than assuming a result property.
Require Tool.inputSchema during deserialization #1600
- Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
- Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
Require explicit PKCE S256 support in OAuth metadata #1700
- OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
- Update the authorization server metadata to declare PKCE S256 support.
Send application_type during dynamic client registration #1613
- Dynamic client registration requests now include an inferred application_type.
- Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
Propagate underlying SSE connection exceptions #1432
- Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
- Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
Fail OAuth step-up when a challenge makes no progress #1591
- A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
- Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

Add InheritEnvironmentVariables to StdioClientTransportOptions #1563 by @halter73
Stop logging stdio transport environment variables #1538 by @halter73 (co-authored by @Copilot)
Implement SEP-2243 HTTP header standardization #1553 by @mikekistler (co-authored by @tarekgh @Copilot)
Append offline_access to authorization scope when advertised (SEP-2207) #1479 by @stephentoub (co-authored by @Copilot)
Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #1558 by @jayaraman-venkatesan
Add APIs for pre-populating the McpClient tool cache #1590 by @tarekgh
Add ScopeSelectorDelegate to OAuth options #1596 by @halllo
Validate the authenticated user on Streamable HTTP session deletion #1604 by @halter73
... (truncated)

2.0.0-rc.2

This second 2.0 release candidate advances the SDK’s 2026-07-28 protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.

Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #1752
- Aligns with protocol adjustment #3002.
- DiscoverResult.ServerInfo is removed; read and deserialize Meta[MetaKeys.ServerInfo] instead.
- On 2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods with server/discover, _meta log level, and subscriptions/listen.
Validate OAuth authorization state #1726
- Custom authorization callback handlers must propagate the redirect state through AuthorizationResult.State, and should return Code, State, and Iss.
Fix SSE session transport shutdown behavior #1432
- Handle the underlying transport exception rather than depending on an IOException wrapper.

What's Changed

Fix SSE session transport shutdown behavior #1432 by @xue-cai (co-authored by @Copilot)
Validate OAuth authorization state #1726 by @halter73 (co-authored by @Copilot)
Add configurable Tasks execution modes and complete conformance support #1741 by @PranavSenthilnathan (co-authored by @Copilot)
Gate 2026-07-28 result fields by negotiated protocol version #1753 by @tarekgh
Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #1752 by @pcarleton (co-authored by @tarekgh @Copilot)
Reauthorize tools changed by call-tool filters #1737 by @PranavSenthilnathan (co-authored by @Copilot)

Documentation Updates

Refine 2.0.0 concept documentation #1742 by @jeffhandley (co-authored by @Copilot)

Test Improvements

Resolve test-server paths deterministically #1735 by @PranavSenthilnathan (co-authored by @Copilot)
Add MCP Apps NativeAOT coverage #1711 by @lntutor
Add MCP Apps _meta.ui serialization round-trip tests #1698 by @yayayouyou

Repository Infrastructure Updates

Bump actions/setup-node from 6.4.0 to 7.0.0 #1717
Bump coverlet.collector from 10.0.0 to 10.0.1 #1582
Bump qs from 6.14.2 to 6.15.2 #1597
Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #1716
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #1569
Bump actions/checkout from 6 to 7 #1665
Rename MCPEXP002 extensibility constants #1739 by @arimu1
Bump the testing-frameworks group #1746
Bump the serilog-testing group #1748
Bump actions/checkout from 7.0.0 to 7.0.1 #1745
Bump Anthropic from 12.17.0 to 12.39.0 #1750
Bump OpenTelemetry and five other dependencies #1747
... (truncated)

2.0.0-rc.1

2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.

We remain on-track to release 2.0.0 stable on or before 2026-07-28.

We want to give a big thanks to @KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #1720, fixed by #1722!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

Remove the preview task-scope helper #1722
- McpTasksServerExtensions.CreateMcpTaskScope(...) was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.
- There is no stable direct replacement; update affected task-scope integration code for the current Tasks APIs.
Harden OAuth issuer validation #1605
- AuthorizationRedirectDelegate now produces MCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.
- Migrate to AuthorizationCallbackHandler and return AuthorizationResult.
Require advertised PKCE S256 support #1700
- Authorization servers that omit code_challenge_methods_supported: ["S256"] now cause authentication to fail instead of receiving an inferred default.
- Correct the authorization-server metadata or use a compliant discovery document.
Send Dynamic Client Registration application types #1613
- Unset ApplicationType now sends an inferred application_type instead of omitting it.
- Set DynamicClientRegistrationOptions.ApplicationType explicitly when the authorization server requires another value.

What's Changed

Require advertised PKCE S256 support #1700 by @PranavSenthilnathan (co-authored by @Copilot)
Make authorization-provider token caches thread-safe #1708 by @tarekgh
Send application_type in Dynamic Client Registration requests #1613 by @jayaraman-venkatesan (co-authored by @Copilot)
Preserve the original AutoDetect probe status code #1530 by @MukundaKatta
Return JSON-RPC parse errors for over-nested stdio requests #1629 by @adityasingh2400
Implement RFC 9207 issuer validation in ClientOAuthProvider #1605 by @mikekistler (co-authored by @halter73 @Copilot)
Reject mismatched initialize protocol versions #1724 by @halter73 (co-authored by @Copilot)
Fix OAuth client-ID initialization on cold start #1705 by @halter73 (co-authored by @Copilot)
Fix HTTP task-filter composition #1722 by @PranavSenthilnathan (co-authored by @Copilot)
Add initial Tasks extension conformance coverage #1734 by @PranavSenthilnathan (co-authored by @Copilot)

Documentation Updates

Publish a side-by-side, multi-version documentation site with selectable release/1.x (v1.4.1) and main (v2 preview) content #1727 by @jeffhandley (co-authored by @Copilot)
Add Docker-based MCP server deployment guidance #1423 by @john-mckillip (co-authored by @Copilot)
Improve v2 conceptual documentation clarity and consistency #1728 by @gewarren
Improve v1 documentation clarity and consistency, and versioning updates #1729 by @jeffhandley (co-authored by @Copilot)

Test Improvements

Expand npm conformance coverage #1725 by @halter73 (co-authored by @Copilot)
Extend the in-memory server/discover probe timeout to prevent flaky Windows Debug CI hangs #1702 by @PranavSenthilnathan (co-authored by @halter73 @Copilot)
... (truncated)

2.0.0-preview.3

This preview reorganizes the Tasks feature into its own ModelContextProtocol.Extensions.Tasks package, keeping ModelContextProtocol.Core focused on the base protocol while a new generic request-handler and alternate-result surface lets the Tasks package layer on top. It also delivers correctness fixes to the draft 2026-07-28 protocol -- per-request client capabilities, negotiation boundaries, and the resultType discriminator -- plus Streamable HTTP client improvements (an empty-JSON-response fix and a new standalone GET-stream opt-out) and conformance-test consolidation.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

Tasks extracted into the new ModelContextProtocol.Extensions.Tasks package #1693
- The Tasks API -- task result/notification types, McpTaskStatus, IMcpTaskStore/InMemoryMcpTaskStore, the tasks/* request methods, and the client GetTaskAsync/UpdateTaskAsync/CancelTaskAsync/CallToolRawAsync methods -- is removed from ModelContextProtocol.Core and relocated to the new ModelContextProtocol.Extensions.Tasks package under the ModelContextProtocol.Extensions.Tasks namespace.
- Core now exposes a task-agnostic ResultOrAlternate<T> (replacing ResultOrCreatedTask<T>) plus generic extension points -- McpServerRequestHandler, McpServerOptions.RequestHandlers, McpServerHandlers.CallToolWithAlternateHandler, McpRequestFilters.CallToolWithAlternateFilters, and McpServer.InterceptOutgoingRequests -- that the Tasks package builds on.
- Migration: add a PackageReference to ModelContextProtocol.Extensions.Tasks; change using ModelContextProtocol.Protocol; to using ModelContextProtocol.Extensions.Tasks; for task types; the task client/server APIs are now extension methods (McpTasksClientExtensions/McpTasksServerExtensions), and the task store is registered via the new builder extensions instead of McpServerOptions.TaskStore.

Experimental APIs

To support extracting Tasks (#1693), ModelContextProtocol.Core gained a generic server-extension surface -- ResultOrAlternate<T>, McpServerRequestHandler, McpServerOptions.RequestHandlers, McpServerHandlers.CallToolWithAlternateHandler, McpRequestFilters.CallToolWithAlternateFilters, and McpServer.InterceptOutgoingRequests -- that lets extension packages such as ModelContextProtocol.Extensions.Tasks layer behavior onto the server pipeline. These APIs are annotated [Experimental] under diagnostic ID MCPEXP002.

This surface is still being designed: #1704 tracks composing these seams with the normal filter and subscription pipeline (typed custom RPCs, filter composition, and extension-defined subscriptions). Expect these low-level extensibility APIs to change and potentially remain [Experimental] through the 2.0.0 stable release.

What's Changed

Fix request-scoped draft client capabilities #1685 by @PranavSenthilnathan (co-authored by @Copilot)
Tighten draft protocol negotiation boundaries #1692 by @halter73 (co-authored by @Copilot)
Fix missing resultType on complete result responses #1684 by @PranavSenthilnathan (co-authored by @Copilot)
Ignore empty Streamable HTTP JSON responses #1626 by @jstar0
Extract Tasks into the ModelContextProtocol.Extensions.Tasks extension package #1693 by @jeffhandley (co-authored by @Copilot)
Add opt-out for Streamable HTTP standalone GET stream #1699 by @jstar0 (co-authored by @Copilot)

Test Improvements

Re-enable http-custom-headers conformance scenario #1691 by @tarekgh
Run stateful and stateless conformance endpoints in a single server process #1672 by @halter73 (co-authored by @Copilot)

Acknowledgements

@jstar0 made their first contribution in #1626
@cclabadmin submitted #1676 (resolved by #1684)
@cclabadmin submitted #1680 (resolved by #1692)
@DmitryLukyanov submitted #1132 (resolved by #1626)
@KirillOsenkov submitted #1637 (resolved by #1699)
@halter73 @tarekgh @PranavSenthilnathan @jeffhandley reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.2...v2.0.0-preview.3

2.0.0-preview.2

This second preview of the 2.0.0 series advances the SDK's alignment with the upcoming 2026-07-28 MCP protocol revision: it adds client-side conformance diagnostics for the SEP-2549 caching hints, makes Streamable HTTP error responses echo the request id per the base protocol and SEP-2243, and fully stabilizes now-stable protocol properties so consumer-defined source generators serialize them correctly. Separately -- and unrelated to the protocol revision -- it introduces DeferChangedEvents() on McpServerPrimitiveCollection<T> for batching list_changed notifications when registering primitives in bulk. There are no breaking changes relative to v2.0.0-preview.1.

What's Changed

Document caching behavior and warn on non-conformant draft cacheable results (SEP-2549 follow-up) #1669 by @tarekgh
Fully stabilize now-stable protocol properties #1686 by @eiriktsarpalis (co-authored by @Copilot)
Echo request id in post-parse Streamable HTTP error responses #1687 by @tarekgh
Add DeferChangedEvents() to McpServerPrimitiveCollection for batched change notifications #1689 by @jeffhandley (co-authored by @Copilot)

Documentation Updates

Update package READMEs as part of the release process #1683 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

@cclabadmin submitted issue #1677 (resolved by #1687)
@lewing submitted issue #1688 (resolved by #1689)
@PranavSenthilnathan @halter73 @davidortinau @jeffhandley @lewing @tarekgh reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.1...v2.0.0-preview.2

2.0.0-preview.1

This is the first preview of the C# MCP SDK 2.0.0, designed for alignment with the 2026-07-28 MCP specification release. The SDK implements the 2026-07-28 protocol version which fundamentally changes how clients and servers interact -- removing the initialize handshake (SEP-2575), eliminating server-side session state (SEP-2567), introducing Multi Round-Trip Requests (SEP-2322), and deprecating legacy capabilities in favor of the new extensions framework (SEP-2133).

The 2.0.0 SDK is fully backward-compatible with servers and clients using the previous 2024-11-05 protocol version. Clients automatically negotiate down to the legacy initialize handshake when connecting to older servers, and servers continue to accept initialize requests from older clients. API breaking changes in 2.0.0 are limited to two categories: (1) APIs for capabilities deprecated by the new specification (Roots, Sampling, and Logging), which are now marked [Obsolete] with guidance toward their replacements, and (2) experimental APIs whose contracts changed as the specifications were finalized. Stable, non-deprecated APIs from 1.x continue to work without modification.

Protocol Version Negotiation and Handshake Behavior

The 2.0.0 SDK introduces a fundamentally new connection lifecycle:

Default behavior (no configuration needed):

Client sends a server/discover request with MCP-Protocol-Version: 2026-07-28
If the server supports the 2026-07-28 protocol version, it responds with capabilities -- no handshake, no session
If the server returns an error (MethodNotFound, InvalidParams, etc.) or times out (5s default via McpClientOptions.DiscoverProbeTimeout), the client automatically falls back to the legacy initialize handshake with 2025-11-25
Three "modern server" error codes (-32022 UnsupportedProtocolVersion, -32021 MissingRequiredClientCapability, -32020 HeaderMismatch) are never treated as legacy indicators and are surfaced as errors

Opting out of the 2026-07-28 protocol version:

Set McpClientOptions.ProtocolVersion = "2025-11-25" to force the legacy initialize handshake and disable the automatic fallback (a non-null ProtocolVersion now acts as both the requested version and the minimum the client accepts)

Per-request metadata (2026-07-28 protocol version):

Every request carries _meta with io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientInfo, and io.modelcontextprotocol/clientCapabilities
Servers MUST NOT infer capabilities from previous requests -- each request is self-describing

2026-07-28 Spec Alignment: SEP Implementation Status

The 2026-07-28 specification release includes 22 SEPs. The table below summarizes C# SDK status. Remaining work is tracked in the 2026-07-28 Spec Compliance milestone.

SEP	Title	Status	Closed	Open
SEP-2596	Feature Lifecycle and Deprecation Policy	✅ Aligned	--	--
SEP-2484	Require Conformance Tests	🚧 Partial	--	#1653
SEP-1730	SDK Tiers Definition	✅ Aligned	--	--
SEP-2575	Make MCP Stateless	🚧 Partial	#1610, #1671	#1670
SEP-2567	Sessionless MCP via Explicit State Handles	✅ Complete	#1610, #1671	--
SEP-2577	Deprecate Roots, Sampling, and Logging	✅ Complete	#1651	--
SEP-2133	Extensions Framework	✅ Complete	#1642	--
SEP-2663	Tasks Extension	✅ Complete	#1579, #1642	--
SEP-1865	MCP Apps Extension	✅ Complete	#1484	--
SEP-2322	Multi Round-Trip Requests (MRTR)	✅ Complete	#1458, #1642	--
SEP-2260	Require Server Requests Associated with Client Request	✅ Complete	#1458, #1610, #1671	--
SEP-2549	TTL for List Results	🚧 Partial	#1623, #1644	#1645, #1650
SEP-2243	HTTP Standardization	🚧 Partial	#1553, #1603, #1619	#1655
SEP-2106	JSON Schema 2020-12 for inputSchema/outputSchema	✅ Complete	#1568, #1600	--
SEP-2164	Standardize Resource Not Found Error Code	✅ Complete	#1558	--
SEP-2207	OIDC-Flavored Refresh Token Guidance	✅ Complete	#1479	--
SEP-2350	Client-Side Scope Accumulation	✅ Complete	#1591	--
SEP-2351	RFC 8414 Well-Known URI Suffix	✅ Complete	(built-in)	--
SEP-2352	Authorization Server Binding and Migration	🚧 Partial	(built-in)	#1474
... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps ModelContextProtocol.AspNetCore from 1.4.1 to 2.0.0 --- updated-dependencies: - dependency-name: ModelContextProtocol.AspNetCore dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the area-dependencies label Jul 29, 2026

winromulus enabled auto-merge (squash) July 29, 2026 01:12

winromulus approved these changes Jul 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the all-dependencies group with 1 update - #288

Bump the all-dependencies group with 1 update#288
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/all-dependencies-3231b2c7c8

dependabot Bot commented on behalf of github Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 29, 2026

2.0.0

Breaking Changes

What's Changed

2.0.0-rc.2

Breaking Changes

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

2.0.0-rc.1

Breaking Changes

What's Changed

Documentation Updates

Test Improvements

2.0.0-preview.3

Breaking Changes

Experimental APIs

What's Changed

Test Improvements

Acknowledgements

2.0.0-preview.2

What's Changed

Documentation Updates

Acknowledgements

2.0.0-preview.1

Protocol Version Negotiation and Handshake Behavior

2026-07-28 Spec Alignment: SEP Implementation Status

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant