Skip to content

chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0 - #184

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.7.0
Jul 29, 2026
Merged

chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0#184
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.7.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0.

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.7.0

This release brings full support for protocol version 2026-07-28. The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump github.com/modelcontextprotocol/go-sdk
45d0cdd 
Bumps [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) from 1.6.1 to 1.7.0.
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.6.1...v1.7.0)

---
updated-dependencies:
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added auto-merge dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 29, 2026
@dependabot
dependabot Bot requested a review from janisz as a code owner July 29, 2026 07:53
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code auto-merge labels Jul 29, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) July 29, 2026 07:53
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

E2E Test Results

Commit: 45d0cdd
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)

Tasks:      11/11 passed (100.00%)
Assertions: 32/32 passed (100.00%)
Tokens:     ~55625 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  14393 tokens
  Output: 22288 tokens
Judge used tokens:
  Input:  40581 tokens
  Output: 33411 tokens

@github-actions
github-actions Bot merged commit cea9e8e into main Jul 29, 2026
9 checks passed
@github-actions
github-actions Bot deleted the dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.7.0 branch July 29, 2026 08:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes
@janisz janisz Awaiting requested review from janisz janisz is a code owner

Assignees

No one assigned

Labels

auto-merge dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants