chore(deps): update dependency @modelcontextprotocol/sdk to v1.20.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.8.0 -> 1.20.2

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.20.2

Compare Source

What's Changed

• fix: Zod to JSONSchema pipe strategies by @​pierreliefauche in #​962
• chore: bump version for weekly release by @​felixweinberger in #​1042

New Contributors

• @​pierreliefauche made their first contribution in #​962

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.1...1.20.2

v1.20.1

Compare Source

What's Changed

• fix: Add Accept header to auth metadata request by @​SVLaursen in #​901
• Allow empty string as valid URL in DCR workflow by @​fredericbarthelet in #​987
• docs: fix summary contents at readme by @​starfish719 in #​1025
• chore: bump version to 1.20.1 for release by @​felixweinberger in #​1032

New Contributors

• @​SVLaursen made their first contribution in #​901
• @​starfish719 made their first contribution in #​1025

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.0...1.20.1

v1.20.0

Compare Source

What's Changed

• docs: improve main README with better quick start, include examples of stateless HTTP, explain tools v resources v prompts by @​domdomegg in #​980
• chore: add lint:fix script by @​mattzcarey in #​1013
• Default to S256 code challenge if not specified in authorization server metadata by @​LucaButBoring in #​992

New Contributors 🙏

• @​mattzcarey made their first contribution in #​1013

Full Changelog: modelcontextprotocol/typescript-sdk@1.19.0...1.20.0

v1.19.1

Compare Source

v1.18.2

Compare Source

What's Changed

• Updates the sampling code example in the README by @​viniciuscsouza in #​958
• Use redirect Uri passed in in demoInMemoryOAuthProvider by @​TylerLeonhardt in #​931
• fix(auth-router): correct Protected Resource Metadata for pathful RS and add explicit resourceServerUrl (RFC 9728) by @​blustAI in #​858
• chore: update version to 1.18.2 for weekly release by @​felixweinberger in #​970

New Contributors

• @​viniciuscsouza made their first contribution in #​958
• @​TylerLeonhardt made their first contribution in #​931
• @​blustAI made their first contribution in #​858

Full Changelog: modelcontextprotocol/typescript-sdk@1.18.1...1.18.2

v1.18.1

Compare Source

What's Changed

• fix: prevent streamable http wite after end from crashing the node process by @​MQ37 in #​933
• chore: update version to 1.18.1 for weekly release by @​felixweinberger in #​950

New Contributors

• @​MQ37 made their first contribution in #​933

Full Changelog: modelcontextprotocol/typescript-sdk@1.18.0...1.18.1

v1.18.0

Compare Source

What's Changed

• mcp: update SDK for SEP 973 + add to example server by @​jesselumarie in #​904
• feat: add _meta field support to tool definitions by @​knguyen-figma in #​922
• Fix automatic log level handling for sessionless connections by @​cliffhall in #​917
• 1.17.6 by @​ihrpr in #​936
• 1.18.0 by @​ihrpr in #​937
• ignore icons for now by @​ihrpr in #​938

New Contributors

• @​jesselumarie made their first contribution in #​904
• @​knguyen-figma made their first contribution in #​922

Full Changelog: modelcontextprotocol/typescript-sdk@1.17.5...1.18.0

v1.17.5

Compare Source

What's Changed

• Automatic handling of logging level by @​cliffhall in #​882
• Fix the SDK vs Spec types test that is breaking CI by @​cliffhall in #​908

Full Changelog: modelcontextprotocol/typescript-sdk@1.17.4...1.17.5

v1.17.4

Compare Source

What's Changed

• feature(middleware): Composable fetch middleware for auth and cross‑cutting concerns by @​m-paternostro in #​485
• restrict url schemes allowed in oauth metadata by @​pcarleton in #​877
• [auth] OAuth protected-resource-metadata: fallback on 4xx not just 404 by @​pcarleton in #​879
• chore: bump version to 1.17.4 by @​felixweinberger in #​894

Full Changelog: modelcontextprotocol/typescript-sdk@1.17.3...1.17.4

v1.17.3

Compare Source

What's Changed

• Fix quit command in Example client with OAuth by @​DaleSeo in #​864
• fix: client import & server imports by @​jatinsandilya in #​851
• fix: pass fetchfn parameter to registerClient and refreshAuthorizatio… by @​arjunkmrm in #​850
• docs: correct parameter schema key in Dynamic Servers documentation by @​bianbianzhu in #​789
• version: patch to 0.17.3 by @​felixweinberger in #​878

New Contributors

• @​DaleSeo made their first contribution in #​864
• @​jatinsandilya made their first contribution in #​851
• @​arjunkmrm made their first contribution in #​850
• @​bianbianzhu made their first contribution in #​789

Full Changelog: modelcontextprotocol/typescript-sdk@1.17.2...1.17.3

v1.17.2

Compare Source

What's Changed

• fix: retry next endpoint on CORS error during auth server discovery by @​xiaoyijun in #​827

Full Changelog: modelcontextprotocol/typescript-sdk@1.17.1...1.17.2

v1.17.1

Compare Source

What's Changed

• (fix): Update fallbackRequestHandler type to match _requestHandlers leaves type by @​fredericbarthelet in #​784
• fix: prevent responses being sent to wrong client when multiple transports connect by @​grimmerk in #​820
• 1.17.1 by @​ihrpr in #​831

Full Changelog: modelcontextprotocol/typescript-sdk@1.17.0...1.17.1

v1.17.0

Compare Source

What's Changed

• Add CODEOWNERS file for sdk by @​ihrpr in #​781
• Add more robust base64 check by @​cliffhall in #​786
• update codeowners by @​ihrpr in #​803
• Fix indent by @​jiec-msft in #​807
• fix: Explicitly declare accpet type to json when exchanging oauth token by @​JoJoJoJoJoJoJo in #​801
• feat: support oidc discovery in client sdk by @​xiaoyijun in #​652
• fix: remove extraneous code block in README.md by @​sd0ric4 in #​791
• Bump form-data from 4.0.2 to 4.0.4 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​798
• Bump version 1.17.0 by @​ihrpr in #​810

New Contributors 🙏

• @​jiec-msft made their first contribution in #​807
• @​sd0ric4 made their first contribution in #​791

Full Changelog: modelcontextprotocol/typescript-sdk@1.16.0...1.17.0

v1.16.0

Compare Source

What's Changed

• Add type compatibility test between SDK and spec types by @​ochafik in #​729
• Add OIDC ID token support by @​dankelleher in #​680
• Add prompt=consent for OIDC offline_access scope by @​dankelleher in #​681
• Non-critical: Readme syntax and typographical error fixes by @​freakynit in #​765
• make client side client_id generation configurable in the oauth router by @​cdaguerre in #​734
• Adding invalidateCredentials() to OAuthClientProvider by @​geelen in #​570
• fix: use authorization_server_url as issuer when fetching metadata by @​JoJoJoJoJoJoJo in #​763
• feat(protocol): Debounce notifications to improve network efficiancy by @​jneums in #​746
• fix(731): StreamableHTTPClientTransport Fails to Reconnect on Non-Resumable Streams by @​jneums in #​732
• fix: consistently use consumer-provided fetch function by @​LucaButBoring in #​767
• fix client id issuance date should only be sent when generated by @​cdaguerre in #​775
• 1.16.0 by @​ihrpr in #​779

New Contributors 🙏

• @​dankelleher made their first contribution in #​680
• @​freakynit made their first contribution in #​765
• @​cdaguerre made their first contribution in #​734
• @​JoJoJoJoJoJoJo made their first contribution in #​763
• @​jneums made their first contribution in #​746
• @​LucaButBoring made their first contribution in #​767

Full Changelog: modelcontextprotocol/typescript-sdk@1.15.1...1.16.0

v1.15.1

Compare Source

What's Changed

• fix(client): Some mcp server need default env(#​393, #​196) by @​sunrabbit123 in #​394
• feat: Add CORS configuration for browser-based MCP clients by @​jerome3o-anthropic in #​713
• Add onsessionclosed hook to StreamableHTTPServerTransport by @​jerome3o-anthropic in #​743
• add custom headers on initial _startOrAuth call by @​anthonjn in #​318
• Improve stdio test Windows compatibility and refactor command logic by @​HoberMin in #​284
• Add missing app.listen error handling to server examples by @​ochafik in #​749
• fix(server): validate expiresAt token value for non existence by @​christian-bromann in #​446
• [auth]: support oauth client_secret_basic / none / custom methods by @​jaredhanson, @​SightStudio, @​ochafik in #​720
• feat: support async callbacks for onsessioninitialized and onsessionclosed by @​jerome3o-anthropic in #​751
• Fix oauth well-known paths to retain path and query by @​ihrpr in #​756
• auth: fetch AS metadata in well-known subpath from serverUrl even when PRM returns external AS by @​ochafik in #​752

New Contributors

• @​sunrabbit123 made their first contribution in #​394
• @​anthonjn made their first contribution in #​318
• @​HoberMin made their first contribution in #​284

Full Changelog: modelcontextprotocol/typescript-sdk@1.15.0...1.15.1

v1.15.0

Compare Source

What's Changed

[!NOTE]
This release reverts a breaking change introduced in version 1.13.3.

• Allow custom fetch in SSEClientTransport and StreamableHTTPClientTransport by @​cliffhall in #​721
• Revert "fix: add type safety for tool output schemas in ToolCallback" by @​sushichan044 in #​725
• bump version to 1.15.0 by @​bhosmer-ant in #​730

Full Changelog: modelcontextprotocol/typescript-sdk@1.14.0...1.15.0

v1.14.0

Compare Source

What's Changed

[!WARNING]
This introduces breaking changes, which are required to comply with the spec - more details

• Rename reject to decline by @​ihrpr in #​727
• 1.14.0 by @​ihrpr in #​728

Full Changelog: modelcontextprotocol/typescript-sdk@1.13.3...1.14.0

v1.13.3

Compare Source

What's Changed

• Implement DNS Rebinding Protections per spec by @​ddworken in #​565
• fix lint by @​ihrpr in #​704
• fix: add missing eventsource-parser dependency by @​domnit in #​424
• fix: add windows env PROGRAMFILES, avoid some exe can not be found by @​muzea in #​386
• add overloads for registerResource method in McpServer class by @​kentcdodds in #​661
• fix: extra headers when they are a Headers object by @​garciasdos in #​571
• fix: missing "properties" property in empty schema by @​sinedied in #​598
• fix: Expose the MCP child process PID as an accessible property in StdioClientTransport by @​XiaofuHuang in #​455
• fix: add type safety for tool output schemas in ToolCallback by @​sushichan044 in #​670
• doc minimum node version requirment by @​marcopeg in #​463
• docs: add error handling when it fails to start HTTP server by @​formulahendry in #​371
• Added Sampling Example to README by @​RishiNandha in #​698
• Returning undefined from discoverOAuthMetadata for CORS errors by @​geelen in #​717
• Bump version to 1.13.3 by @​ihrpr in #​719

New Contributors 🙏

• @​ddworken made their first contribution in #​565
• @​domnit made their first contribution in #​424
• @​muzea made their first contribution in #​386
• @​kentcdodds made their first contribution in #​661
• @​garciasdos made their first contribution in #​571
• @​sinedied made their first contribution in #​598
• @​XiaofuHuang made their first contribution in #​455
• @​sushichan044 made their first contribution in #​670
• @​marcopeg made their first contribution in #​463
• @​formulahendry made their first contribution in #​371
• @​RishiNandha made their first contribution in #​698

Full Changelog: modelcontextprotocol/typescript-sdk@1.13.2...1.13.3

v1.13.2

Compare Source

What's Changed

• Fix /.well-known/oauth-authorization-server dropping path by @​calclavia in #​687
• Fallback for /.well-known/oauth-authorization-server dropping path by @​ihrpr in #​692
• [auth] refactor resource selection to not include resource if PRM is not present by @​pcarleton in #​693
• fix: skip validation if tool reports error by @​Areo-Joe in #​655
• feat(shared/auth): support software_statement in OAuthClientMetadata by @​chrisdickinson in #​696
• Show session id per request in simpleStreamableHttp example server by @​cliffhall in #​640
• Raw request propagation in tools - passed to callbacks via RequestHandlerExtra<ServerRequest, ServerNotification> by @​KKonstantinov in #​627
• Update readme file to include a tip to allow mcp-session-id in CORS when using StreamableHTTP by @​Achintha444 in #​633
• Pr/protocol overwriting transport hooks by @​nichtsam in #​477
• docs: Add clarifying comments for stateless streamable HTTP endpoints by @​dhodun in #​542
• Bump formidable from 3.5.2 to 3.5.4 in the npm_and_yarn group across 1 directory by @​dependabot in #​428
• test(server): add more tests for SSEServerTransport class by @​christian-bromann in #​391
• Update version of the package to 1.13.2 by @​ihrpr in #​701

New Contributors 🙏

• @​calclavia made their first contribution in #​687
• @​Areo-Joe made their first contribution in #​655
• @​KKonstantinov made their first contribution in #​627
• @​Achintha444 made their first contribution in #​633
• @​nichtsam made their first contribution in #​477
• @​dhodun made their first contribution in #​542
• @​christian-bromann made their first contribution in #​391

Full Changelog: modelcontextprotocol/typescript-sdk@1.13.1...1.13.2

v1.13.1

Compare Source

What's Changed

• simpleStreamableHttp: fix example code by @​ochafik in #​660
• build: add watching script targets for build & simple streamable http server by @​ochafik in #​663
• feat: remove console statements from SDK code by @​ashwin-ant in #​668
• [auth] adjust default validation for resource parameter in client flow, and server example by @​pcarleton in #​664
• fix(client/sse): extract protected resource from eventsource 401 by @​chrisdickinson in #​675
• 1.13.1 by @​ihrpr in #​683

Full Changelog: modelcontextprotocol/typescript-sdk@1.13.0...1.13.1

v1.13.0

Compare Source

🚀 Implementation for Spec revision 2025-06-18

https://github.com/modelcontextprotocol/modelcontextprotocol/releases/tag/2025-06-18

• feat: implement MCP-Protocol-Version header requirement for HTTP transport by @​ochafik in #​614
• Rename ResourceReference to ResourceTemplateReference by @​ihrpr in #​619
• Adds _meta to additional interface types by @​ihrpr in #​630
• Add title to tools, resources, prompts by @​ihrpr in #​631
• Add support for resource link by @​ihrpr in #​632
• Include context into completions by @​ihrpr in #​634
• Add missing _meta fields to match spec requirements by @​felixweinberger in #​636
• Introduce Elicitation capability by @​ihrpr in #​520
• update _meta usage guidance in types.ts by @​bhosmer-ant in #​639
• Jerome/fix/dev oauth server required scopes change by @​jerome3o-anthropic in #​629
• remove hasCustomTitle by @​ihrpr in #​645
• update latest protocol version by @​ihrpr in #​643
• change version by @​ihrpr in #​647
• RFC 8707 Resource Indicators Implementation by @​ochafik in #​638
• rename decline to reject by @​ihrpr in #​657

New Contributors 🙏

• @​ochafik made their first contribution in #​614
• @​felixweinberger made their first contribution in #​636

Full Changelog: modelcontextprotocol/typescript-sdk@1.12.3...1.13.0

v1.12.3

Compare Source

What's Changed

• 1.12.3 by @​ihrpr in #​623

Full Changelog: modelcontextprotocol/typescript-sdk@1.12.2...1.12.3

v1.12.2

Compare Source

What's Changed

• fix: Ensure completions capability is registered on setCompletionRequestHandler call by @​fredericbarthelet in #​546
• fixes metadata for listed resources from resource templates so that they favor their own metadata by @​carlpeaslee in #​574
• Adding tests to prevent regressions for: fixes metadata for listed resources from resource templates so that they favor their own metadata by @​ihrpr in #​621

New Contributors

• @​carlpeaslee made their first contribution in #​574

Full Changelog: modelcontextprotocol/typescript-sdk@1.12.1...1.12.2

v1.12.1

Compare Source

What's Changed

• chore: fix typo by @​Skn0tt in #​315
• Add request init headers defined on the sse transport on the start phase by @​danielgek in #​538
• fix: Ensure _meta object is not lost when onprogress option is passed by @​daidi in #​560

New Contributors

• @​Skn0tt made their first contribution in #​315
• @​danielgek made their first contribution in #​538
• @​daidi made their first contribution in #​560

Full Changelog: modelcontextprotocol/typescript-sdk@1.12.0...1.12.1

v1.12.0

Compare Source

Authorization spec: DRAFT-2025-v2 🔐 🚀

• feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2) by @​pcarleton in #​503
• Feat: Separate authorization server and resource server on client auth flow by @​0Itsuki0 in #​416
• Example Auth client by @​ihrpr in #​526

Other changes

• Add support for message field in progress notifications by @​bhosmer-ant in #​502
• Fix Ajv import compatibility issue by downgrading to v6 by @​bhosmer-ant in #​517
• fix: ProxyOAuthServerProvider: redirect_uri missing in token request by @​shubham-lohar in #​519
• Save existing refresh_token in store if no new refresh_token is returned by @​fredericbarthelet in #​483
  #​527
• Add state param to OAuth provider by @​jescalan in #​529
• Fix StreamableHttp example for tool calls - have a separate option for testing notifications resumption by @​ihrpr in #​534

New Contributors

• @​0Itsuki0 made their first contribution in #​416
• @​shubham-lohar made their first contribution in #​519
• @​jescalan made their first contribution in #​529

Full Changelog: modelcontextprotocol/typescript-sdk@1.11.4...1.12.0

v1.11.5

Compare Source

What's Changed

• Make content in Tool Result required by @​bhosmer-ant in #​524

Full Changelog: modelcontextprotocol/typescript-sdk@1.11.4...1.11.5

v1.11.4

Compare Source

What's Changed

• Prototype support for outputSchema/structuredContent by @​bhosmer-ant in #​454
• fix sse endpoint path preservation by @​bhosmer-ant in #​504
• rollback path preservation fix by @​bhosmer-ant in #​506

Full Changelog: modelcontextprotocol/typescript-sdk@1.11.3...1.11.4

v1.11.3

Compare Source

What's Changed

• fix: preserve custom paths in SSE endpoint URLs by @​bhosmer-ant in #​466
• chore: fix cross-spawn version to 7.0.5 (issue: #​488) by @​rafaelportomoura in #​489
• [FEAT] added support for AuthInfo in extra for StreamableHTTPServerTransport by @​its-nikhil in #​399
• feat(auth): support custom scope in authorization requests by @​xiaoyijun in #​491
• Fix notificaions in README.md by @​Boyquotes in #​480
• docs: Fix import paths for ProxyOAuthServerProvider in README by @​grimmerk in #​457
• Fix Table of Contents in README and markdown linter warnings. by @​petervandenabeele in #​449

New Contributors

• @​rafaelportomoura made their first contribution in #​489
• @​its-nikhil made their first contribution in #​399
• @​xiaoyijun made their first contribution in #​491
• @​Boyquotes made their first contribution in #​480
• @​grimmerk made their first contribution in #​457
• @​petervandenabeele made their first contribution in #​449

Full Changelog: modelcontextprotocol/typescript-sdk@1.11.2...1.11.3

v1.11.2

Compare Source

What's Changed

• feat: Add scope parameter to startAuthorization function by @​pcarleton in #​464
• Fix Zod object detection logic by @​geelen in #​468

New Contributors

• @​pcarleton made their first contribution in #​464

Full Changelog: modelcontextprotocol/typescript-sdk@1.11.1...1.11.2

v1.11.1

Compare Source

What's Changed

• Fix isZodRawShape return false on empty object and add test by @​yuna0x0 in #​448

New Contributors

• @​yuna0x0 made their first contribution in #​448

Full Changelog: modelcontextprotocol/typescript-sdk@1.11.0...1.11.1

v1.11.0

Compare Source

🚀 Tool Annotations

Adding support for Tools Annotations for better describing tool behavior, like whether it is read-only or destructive, as per protocol version 2025-03-26

Spec Version Update

Since we implemented most of the features in the recent spec we are updating the latest protocol version

Other Changes

• Pass requestId to handlers via metadata by @​lforst in #​358
• stateless had a wrong example by @​TomasRup in #​338
• fix SSE transport server examples by @​ihrpr in #​388
• Update README.md to include working examples by @​simonedstrom96 in #​384
• Pass request _meta to request handlers extra param by @​iamarcel in #​328
• Update stateless streamable http usecase by @​c121914yu in #​417
• Add 401 during POST request test case on StreamableHTTP transport to check auth flow by @​fredericbarthelet in [#​411](https://redirect.github.com/modelcontext

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bupd]

lgtm