Skip to content

chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.1.0 to 1.4.0#47

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.0
Open

chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.1.0 to 1.4.0#47
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 2, 2026

Bumps github.com/modelcontextprotocol/go-sdk from 1.1.0 to 1.4.0.

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.4.0

This release marks the completion of the full 2025-11-25 specification implementation, by introducing the support for Sampling with Tools and experimental client-side OAuth support. It also contains multiple bug fixes and improvements. Thanks to all contributors!

Client-side OAuth support

This release introduces experimental support for OAuth on the client side of the SDK. It aims to support the full scope of the current MCP specification for authorization. To use it, you need to compile the SDK with the -tags mcp_go_client_oauth flag. Some changes may still be applied to this new API, based on developer feedback. The functionality is planned to become stable in v1.5.0 release, expected by the end of March 2026. More details can be found at https://github.com/modelcontextprotocol/go-sdk/blob/main/docs/protocol.md#client.

Sampling with Tools

Starting from this release, the server use the new CreateMessageWithTools method to create a sampling request to the client that contains tools that can be used by the client. On the client side, CreateMessageWithToolsHandler may be used to handle such requests and issue ToolUse responses to the server.

Behavior changes

We have two important behavior changes that were introduced to fix a bug or improve security posture. They can be temporarily turned off by specifying a special MCPGODEBUG environment variable when running the SDK. Different options can be added together, separated by a comma.

Introduced DNS rebinding protection (MCPGODEBUG=disablelocalhostprotection=1)

The requests arriving via a localhost address (127.0.0.1, [::1]) that have a non-localhost Host header will be rejected to protect against DNS rebinding attacks. The option to remove this protection will be removed in v1.6.0.

Removed JSON content escaping when marshaling (MCPGODEBUG=jsonescaping=1):

By default encoding/json escapes the contents of the objects, which causes some servers to fail. We switched to no escaping by default. The option to bring back the escaping will be removed in v1.6.0.

Bug fixes

Security vulnerability caused by the case insensitive parsing behavior of encoding/json has been submitted (also release as a cherry pick in v1.3.1). Security advisory has been posted.

Other fixes:

Enhancements

Notably, the SDK now supports the extensions field in client and server capabilities, which should enable creation of MCP Apps.

Other enhancements:

... (truncated)

Commits
  • c9317fb all: client side OAuth support (#785)
  • 4e8b6ca mcp: return 400 instead of 500 when body read fails in stateless mode (#817)
  • 0048a18 chore: Configure advanced CodeQL setup (#819)
  • 1942036 chore: update the version of the conformance suite. (#814)
  • b17143f chore: increase timeout for conformance server start. (#813)
  • 86d05a1 chore: update publish-docs permissions to be more targeted. (#812)
  • 9f22cf1 chore: configure a simple AGENTS.md file and a skill for fixing GitHu… (#810)
  • 51d256c chore: Configure OSSF Scorecard action (#811)
  • ac65640 chore: update SECURITY.md to use GitHub Security Advisories (#809)
  • 7b8d81c all: use case-sensitive JSON unmarshaling (#807)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) from 1.1.0 to 1.4.0.
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.1.0...v1.4.0)

---
updated-dependencies:
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 2, 2026
@dependabot dependabot bot requested a review from janisz as a code owner March 2, 2026 07:58
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants