[Snyk] Upgrade @modelcontextprotocol/sdk from 1.12.3 to 1.17.0 #8
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade @modelcontextprotocol/sdk from 1.12.3 to 1.17.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 9 versions ahead of your current version.
The recommended version was released 22 days ago.
Release notes
Package name: @modelcontextprotocol/sdk
-
1.17.0 - 2025-07-24
- Add CODEOWNERS file for sdk by @ ihrpr in #781
- Add more robust base64 check by @ cliffhall in #786
- update codeowners by @ ihrpr in #803
- Fix indent by @ jiec-msft in #807
- fix: Explicitly declare accpet type to json when exchanging oauth token by @ JoJoJoJoJoJoJo in #801
- feat: support oidc discovery in client sdk by @ xiaoyijun in #652
- fix: remove extraneous code block in README.md by @ sd0ric4 in #791
- Bump form-data from 4.0.2 to 4.0.4 in the npm_and_yarn group across 1 directory by @ dependabot[bot] in #798
- Bump version 1.17.0 by @ ihrpr in #810
- @ jiec-msft made their first contribution in #807
- @ sd0ric4 made their first contribution in #791
-
1.16.0 - 2025-07-17
- Add type compatibility test between SDK and spec types by @ ochafik in #729
- Add OIDC ID token support by @ dankelleher in #680
- Add prompt=consent for OIDC offline_access scope by @ dankelleher in #681
- Non-critical: Readme syntax and typographical error fixes by @ freakynit in #765
- make client side client_id generation configurable in the oauth router by @ cdaguerre in #734
- Adding
- fix: use authorization_server_url as issuer when fetching metadata by @ JoJoJoJoJoJoJo in #763
- feat(protocol): Debounce notifications to improve network efficiancy by @ jneums in #746
- fix(731): StreamableHTTPClientTransport Fails to Reconnect on Non-Resumable Streams by @ jneums in #732
- fix: consistently use consumer-provided fetch function by @ LucaButBoring in #767
- fix client id issuance date should only be sent when generated by @ cdaguerre in #775
- 1.16.0 by @ ihrpr in #779
- @ dankelleher made their first contribution in #680
- @ freakynit made their first contribution in #765
- @ cdaguerre made their first contribution in #734
- @ JoJoJoJoJoJoJo made their first contribution in #763
- @ jneums made their first contribution in #746
- @ LucaButBoring made their first contribution in #767
-
1.15.1 - 2025-07-10
- fix(client): Some mcp server need default env(#393, #196) by @ sunrabbit123 in #394
- feat: Add CORS configuration for browser-based MCP clients by @ jerome3o-anthropic in #713
- Add onsessionclosed hook to StreamableHTTPServerTransport by @ jerome3o-anthropic in #743
- add custom headers on initial _startOrAuth call by @ anthonjn in #318
- Improve stdio test Windows compatibility and refactor command logic by @ HoberMin in #284
- Add missing app.listen error handling to server examples by @ ochafik in #749
- fix(server): validate expiresAt token value for non existence by @ christian-bromann in #446
- [auth]: support oauth client_secret_basic / none / custom methods by @ jaredhanson, @ SightStudio, @ ochafik in #720
- feat: support async callbacks for onsessioninitialized and onsessionclosed by @ jerome3o-anthropic in #751
- Fix oauth well-known paths to retain path and query by @ ihrpr in #756
- auth: fetch AS metadata in well-known subpath from serverUrl even when PRM returns external AS by @ ochafik in #752
- @ sunrabbit123 made their first contribution in #394
- @ anthonjn made their first contribution in #318
- @ HoberMin made their first contribution in #284
-
1.15.0 - 2025-07-03
- Allow custom fetch in SSEClientTransport and StreamableHTTPClientTransport by @ cliffhall in #721
- Revert "fix: add type safety for tool output schemas in ToolCallback" by @ sushichan044 in #725
- bump version to 1.15.0 by @ bhosmer-ant in #730
-
1.14.0 - 2025-07-03
- Rename reject to decline by @ ihrpr in #727
- 1.14.0 by @ ihrpr in #728
-
1.13.3 - 2025-07-01
- Implement DNS Rebinding Protections per spec by @ ddworken in #565
- fix lint by @ ihrpr in #704
- fix: add missing eventsource-parser dependency by @ domnit in #424
- fix: add windows env PROGRAMFILES, avoid some exe can not be found by @ muzea in #386
- add overloads for registerResource method in McpServer class by @ kentcdodds in #661
- fix: extra headers when they are a Headers object by @ garciasdos in #571
- fix: missing "properties" property in empty schema by @ sinedied in #598
- fix: Expose the MCP child process PID as an accessible property in StdioClientTransport by @ XiaofuHuang in #455
- fix: add type safety for tool output schemas in ToolCallback by @ sushichan044 in #670
- doc minimum node version requirment by @ marcopeg in #463
- docs: add error handling when it fails to start HTTP server by @ formulahendry in #371
- Added Sampling Example to README by @ RishiNandha in #698
- Returning undefined from
- Bump version to 1.13.3 by @ ihrpr in #719
- @ ddworken made their first contribution in #565
- @ domnit made their first contribution in #424
- @ muzea made their first contribution in #386
- @ kentcdodds made their first contribution in #661
- @ garciasdos made their first contribution in #571
- @ sinedied made their first contribution in #598
- @ XiaofuHuang made their first contribution in #455
- @ sushichan044 made their first contribution in #670
- @ marcopeg made their first contribution in #463
- @ formulahendry made their first contribution in #371
- @ RishiNandha made their first contribution in #698
-
1.13.2 - 2025-06-26
-
1.13.1 - 2025-06-23
-
1.13.0 - 2025-06-18
-
1.12.3 - 2025-06-13
from @modelcontextprotocol/sdk GitHub release notesWhat's Changed
New Contributors 🙏
Full Changelog: 1.16.0...1.17.0
What's Changed
invalidateCredentials()toOAuthClientProviderby @ geelen in #570New Contributors 🙏
Full Changelog: 1.15.1...1.16.0
What's Changed
New Contributors
Full Changelog: 1.15.0...1.15.1
What's Changed
Note
This release reverts a breaking change introduced in version 1.13.3.
Full Changelog: 1.14.0...1.15.0
What's Changed
Warning
This introduces breaking changes, which are required to comply with the spec - more details
Full Changelog: 1.13.3...1.14.0
What's Changed
discoverOAuthMetadatafor CORS errors by @ geelen in #717New Contributors 🙏
Full Changelog: 1.13.2...1.13.3
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: