Bump the mcp-deps group across 2 directories with 1 update

[dependabot]

Bumps the mcp-deps group with 1 update in the /projects/mcp/brave directory: io.modelcontextprotocol:kotlin-sdk.
Bumps the mcp-deps group with 1 update in the /projects/mcp/mcp-demo directory: io.modelcontextprotocol:kotlin-sdk.

Updates io.modelcontextprotocol:kotlin-sdk from 0.12.0 to 0.14.0

Release notes

Sourced from io.modelcontextprotocol:kotlin-sdk's releases.

0.13.0

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @​devcrocod in #732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @​devcrocod in #778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #573, #574, #708).

DNS rebinding protection enabled by default by @​devcrocod in #659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

• Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @​devcrocod in #732
• Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @​devcrocod in #778

Fixed

• Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @​jskjw157 in #738

Security

• Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @​devcrocod in #659
• Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @​devcrocod in 6e6f805

Maintenance

• Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @​devcrocod in #754

Dependencies

• Ktor to v3.4.3 in #785
• kotlinx.coroutines to v1.11.0 in #760
• kotlin-logging to v8.0.03 in #752, #783
• 24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: modelcontextprotocol/kotlin-sdk@0.12.0...0.13.0

Commits

• fc7916f release: 0.14.0 (#867)
• 57e546d feat: SEP-1686 Tasks (#844)
• 35da063 fix: bound request body size in SSE and Streamable HTTP transports (#839)
• bbf77ba chore(deps): bump @​types/node from 26.0.0 to 26.0.1 in /integration-test/src/...
• d2b1509 chore(deps): bump the other-dependencies group across 5 directories with 5 up...
• 0221b8d fix(client): close stdio read sources during shutdown (#798)
• 19db4b0 fix(client): gate completion/complete on the completions capability (#846)
• 64cf29f chore(deps): bump gradle-wrapper from 9.6.0 to 9.6.1 (#856)
• cd91652 fix: validate Origin against localhost by default in DNS rebinding protection...
• 4103b87 chore(deps): bump org.jetbrains.kotlinx:kotlinx-io-core from 0.9.0 to 0.9.1 i...
• Additional commits viewable in compare view

Updates io.modelcontextprotocol:kotlin-sdk from 0.12.0 to 0.14.0

Release notes

Sourced from io.modelcontextprotocol:kotlin-sdk's releases.

0.13.0

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @​devcrocod in #732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @​devcrocod in #778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #573, #574, #708).

DNS rebinding protection enabled by default by @​devcrocod in #659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

• Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @​devcrocod in #732
• Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @​devcrocod in #778

Fixed

• Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @​jskjw157 in #738

Security

• Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @​devcrocod in #659
• Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @​devcrocod in 6e6f805

Maintenance

• Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @​devcrocod in #754

Dependencies

• Ktor to v3.4.3 in #785
• kotlinx.coroutines to v1.11.0 in #760
• kotlin-logging to v8.0.03 in #752, #783
• 24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: modelcontextprotocol/kotlin-sdk@0.12.0...0.13.0

Commits

• fc7916f release: 0.14.0 (#867)
• 57e546d feat: SEP-1686 Tasks (#844)
• 35da063 fix: bound request body size in SSE and Streamable HTTP transports (#839)
• bbf77ba chore(deps): bump @​types/node from 26.0.0 to 26.0.1 in /integration-test/src/...
• d2b1509 chore(deps): bump the other-dependencies group across 5 directories with 5 up...
• 0221b8d fix(client): close stdio read sources during shutdown (#798)
• 19db4b0 fix(client): gate completion/complete on the completions capability (#846)
• 64cf29f chore(deps): bump gradle-wrapper from 9.6.0 to 9.6.1 (#856)
• cd91652 fix: validate Origin against localhost by default in DNS rebinding protection...
• 4103b87 chore(deps): bump org.jetbrains.kotlinx:kotlinx-io-core from 0.9.0 to 0.9.1 i...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, mcp. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.