dependabot[bot] opened a new pull request, #16472: URL: https://github.com/apache/dubbo/pull/16472
Bumps [io.modelcontextprotocol.sdk:mcp](https://github.com/modelcontextprotocol/java-sdk) from 0.11.2 to 0.18.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/java-sdk/releases";>io.modelcontextprotocol.sdk:mcp's releases</a>.</em></p> <blockquote> <h2>v0.18.4</h2> <h2>What's changed</h2> <ul> <li>Bound HTTP client and server reads (backported from <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/issues/1102";>#1102</a> by <a href="https://github.com/Kehrlann";><code>@Kehrlann</code></a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.3...v0.18.4";>https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.3...v0.18.4</a></p> <h2>v0.18.3</h2> <h2>What's changed</h2> <p>Fix for GHSA-hv2w-8mjj-jw22</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.2...v0.18.3";>https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.2...v0.18.3</a></p> <h2>v0.18.2</h2> <h2>What's Changed</h2> <ul> <li>Validate message endpoint in SSE client transport by <a href="https://github.com/Kehrlann";><code>@Kehrlann</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/945";>modelcontextprotocol/java-sdk#945</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.1...v0.18.2";>https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.1...v0.18.2</a></p> <h2>v0.18.1</h2> <h2>What's Changed</h2> <ul> <li>Fix and simplification for osgi manifest.mf contents generation - Cherry-picked from main (<a href="https://github.com/modelcontextprotocol/java-sdk/commit/159eb964cc6252afb977c7fc8531748d24954784";>https://github.com/modelcontextprotocol/java-sdk/commit/159eb964cc6252afb977c7fc8531748d24954784</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.0...v0.18.1";>https://github.com/modelcontextprotocol/java-sdk/compare/v0.18.0...v0.18.1</a></p> <h2>v0.18.0</h2> <h2>What's Changed</h2> <ul> <li>fix: Fixed html encoding in javadoc by <a href="https://github.com/ashakirin";><code>@ashakirin</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/727";>modelcontextprotocol/java-sdk#727</a></li> <li>fix: Enable javadoc generation for modules with OSGi metadata by <a href="https://github.com/jonathanhefner";><code>@jonathanhefner</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/705";>modelcontextprotocol/java-sdk#705</a></li> <li>fix: Support form and url fields in Elicitation capability per 2025-11-25 spec by <a href="https://github.com/rhtnr";><code>@rhtnr</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/731";>modelcontextprotocol/java-sdk#731</a></li> <li>add 2025-11-25 version to ProtocolVersions by <a href="https://github.com/sdelamo";><code>@sdelamo</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/733";>modelcontextprotocol/java-sdk#733</a></li> <li>Expose resourcesUpdateConsumer() in sync client by <a href="https://github.com/Randgalt";><code>@Randgalt</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/735";>modelcontextprotocol/java-sdk#735</a></li> <li>Upgrade to testcontainers 1.21.4 by <a href="https://github.com/sdeleuze";><code>@sdeleuze</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/743";>modelcontextprotocol/java-sdk#743</a></li> <li>Fix everything-server-based tests by <a href="https://github.com/chemicL";><code>@chemicL</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/756";>modelcontextprotocol/java-sdk#756</a></li> <li>Add Support for Jackson 3 and use it by default by <a href="https://github.com/filiphr";><code>@filiphr</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/742";>modelcontextprotocol/java-sdk#742</a></li> <li>Decouple mcp-test and mcp-spring modules from Jackson implementation by <a href="https://github.com/chemicL";><code>@chemicL</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/760";>modelcontextprotocol/java-sdk#760</a></li> <li>Conformance tests by <a href="https://github.com/chemicL";><code>@chemicL</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/767";>modelcontextprotocol/java-sdk#767</a></li> <li>Use junit.version for all junit dependencies by <a href="https://github.com/filiphr";><code>@filiphr</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/752";>modelcontextprotocol/java-sdk#752</a></li> <li>Update JUnit 5.10.2 -> 6.0.2 by <a href="https://github.com/Kehrlann";><code>@Kehrlann</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/769";>modelcontextprotocol/java-sdk#769</a></li> <li>Validate origin header by <a href="https://github.com/Kehrlann";><code>@Kehrlann</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/771";>modelcontextprotocol/java-sdk#771</a></li> <li>feat: broadcast 2025-11-25 as latest supported client version by <a href="https://github.com/LucaButBoring";><code>@LucaButBoring</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/758";>modelcontextprotocol/java-sdk#758</a></li> <li>feat: added tools name format validation accordingly #SEP-986 by <a href="https://github.com/ashakirin";><code>@ashakirin</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/764";>modelcontextprotocol/java-sdk#764</a></li> <li>Moves mcp-json API back into mcp-core for simplified dependencies and support of osgi runtimes by <a href="https://github.com/Kehrlann";><code>@Kehrlann</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/779";>modelcontextprotocol/java-sdk#779</a></li> <li>DNS rebinding protection: check host header by <a href="https://github.com/Kehrlann";><code>@Kehrlann</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/775";>modelcontextprotocol/java-sdk#775</a></li> <li>Refine <code>McpJsonDefaults</code> method names by <a href="https://github.com/sdeleuze";><code>@sdeleuze</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/789";>modelcontextprotocol/java-sdk#789</a></li> <li>Add embedded MkDocs documentation site by <a href="https://github.com/tzolov";><code>@tzolov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/java-sdk/pull/795";>modelcontextprotocol/java-sdk#795</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/java-sdk/blob/main/CHANGELOG.md";>io.modelcontextprotocol.sdk:mcp's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to the MCP Java SDK are documented in the <a href="https://github.com/modelcontextprotocol/java-sdk/releases";>GitHub Releases</a>, which serve as the canonical, detailed changelog for every version. This file summarizes the release history and the currently maintained release lines.</p> <p>Versioning follows <a href="https://semver.org/";>Semantic Versioning</a>; see <a href="https://github.com/modelcontextprotocol/java-sdk/blob/main/VERSIONING.md";>https://github.com/modelcontextprotocol/java-sdk/blob/main/VERSIONING.md</a> for the breaking-change policy and <a href="https://github.com/modelcontextprotocol/java-sdk/blob/main/SECURITY.md";>https://github.com/modelcontextprotocol/java-sdk/blob/main/SECURITY.md</a> for the supported-versions security policy.</p> <h2>Release lines</h2> <table> <thead> <tr> <th>Line</th> <th>Latest</th> <th>Spec revision</th> <th>Status</th> </tr> </thead> <tbody> <tr> <td>2.0.x</td> <td><a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.1";>2.0.1</a> (2026-08-19)</td> <td>2025-11-25</td> <td>Active development</td> </tr> <tr> <td>1.1.x</td> <td><a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.4";>1.1.4</a> (2026-08-19)</td> <td>2025-06-18</td> <td>Security patches only</td> </tr> <tr> <td>0.18.x</td> <td><a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.4";>0.18.4</a> (2026-08-19)</td> <td>2025-06-18</td> <td>Security patches only</td> </tr> </tbody> </table> <h2>2.0.1 — 2026-08-19</h2> <ul> <li>Bound STDIO and HTTP client/server reads to a configurable maximum size</li> </ul> <p>Full notes: <a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.1";>v2.0.1 release</a></p> <h2>2.0.0 — 2026-06-11</h2> <p>First major release since 1.x, tracking the <strong>2025-11-25</strong> MCP specification. Upgrading from 1.x? See the <a href="https://github.com/modelcontextprotocol/java-sdk/blob/main/MIGRATION-2.0.md";>v2 migration guide</a>.</p> <ul> <li>New JSON compatibility foundation for forward/backward wire compatibility, with pluggable Jackson 2 / Jackson 3 serialization modules</li> <li>Spec-accurate schema: enforced required fields, lenient wire deserialization</li> <li>End-to-end validation of tool inputs and embedded JSON Schema documents (JSON Schema 2020-12, SEP-1613)</li> <li>Richer elicitation: client-side schema defaults (SEP-1034), URL elicitation (SEP-1036), form-based elicitation schemas</li> <li>Icons and metadata support (SEP-973)</li> <li>Streamable HTTP first: SSE transports deprecated in favor of Streamable HTTP</li> <li>Module restructuring: <code>mcp-core</code>, <code>mcp-json-jackson2</code>, <code>mcp-json-jackson3</code>, <code>mcp-bom</code></li> </ul> <p>Full notes: <a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0";>v2.0.0 release</a> (preceded by milestones <a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M1";>M1</a>, <a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M2";>M2</a>, <a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M3";>M3</a>, <a href="https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-RC1";>RC1</a>).</p> <h2>1.x</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/a710d973b699160b796397fe17f082e24c38e0b2";><code>a710d97</code></a> Release version 0.18.4</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/2e5dbd36e066a470f901681eda6882ff010c596a";><code>2e5dbd3</code></a> Bound HTTP client reads</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/8c0fdd1b1f76adba3ce7945d29f73fa2ddc66598";><code>8c0fdd1</code></a> Bound HTTP server reads</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/34ee267a1de84e7f25fd4d572c605a0aaa56a499";><code>34ee267</code></a> Next development version</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/1021461dd857ea5cd44054510010f31297f823d6";><code>1021461</code></a> Release version 0.18.3</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/1c05de2989cefd2175eb772d50b1bb45d4282fdf";><code>1c05de2</code></a> Merge commit from fork</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/b3585c78ba29099bc639f6f564cefdbb3842eb90";><code>b3585c7</code></a> Next development version</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/304650c5a0df3a4be0536bf9eb5bfa3728632823";><code>304650c</code></a> Release version 0.18.2</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/02d1f3edd01b36f1842d2059b155aa56f2632e2a";><code>02d1f3e</code></a> Fix assertion in WebFluxSseClientTransportTests</li> <li><a href="https://github.com/modelcontextprotocol/java-sdk/commit/d782dc93c0782b13509a010b9920ebd6c4c9a90c";><code>d782dc9</code></a> Fix assertions in HttpClientSseClientTransportTests</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/java-sdk/compare/v0.11.2...v0.18.4";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
