deps(composer): bump mcp/sdk from 0.5.0 to 0.6.0 in the composer-dependencies group across 1 directory

[dependabot]

Bumps the composer-dependencies group with 1 update in the / directory: mcp/sdk.

Updates mcp/sdk from 0.5.0 to 0.6.0

Release notes

Sourced from mcp/sdk's releases.

v0.6.0

What's Changed

• [Server] Allow overriding the default file name pattern for Discovery by @​johnhunt-lc in modelcontextprotocol/php-sdk#292
• [Server] force the proper Content-type for the 202 response in createJsonResponse() by @​johnhunt-lc in modelcontextprotocol/php-sdk#295
• [Schema] fix: allow URIs without double slash in Resource and ResourceTemplate (RFC 3986) by @​blackwell-systems in modelcontextprotocol/php-sdk#297
• fix: Cannot pass null to nullable enum parameters by @​SBNTT in modelcontextprotocol/php-sdk#299
• [Server] Fix case sensitivity for http header by @​chr-hertel in modelcontextprotocol/php-sdk#283
• Add PSR-3 compliant exception context when logging exceptions by @​svenmuennich in modelcontextprotocol/php-sdk#300
• [Server] Add configurable session garbage collection by @​chr-hertel in modelcontextprotocol/php-sdk#258
• [CI] Add weekly conformance run against latest upstream release by @​soyuka in modelcontextprotocol/php-sdk#304
• [Client][Server][Schema] Bump protocol version to nov 25 by @​chr-hertel in modelcontextprotocol/php-sdk#308
• [Server] Untangle origin tracking from Registry by @​chr-hertel in modelcontextprotocol/php-sdk#302
• [Schema] Add title field to Resource and ResourceTemplate by @​blackwell-systems in modelcontextprotocol/php-sdk#301
• Add title parameter to Builder::addResource() and addResourceTemplate() by @​chr-hertel in modelcontextprotocol/php-sdk#310
• Streamline README and add conformance score badges by @​chr-hertel in modelcontextprotocol/php-sdk#312
• [Conformance] Fix conformance score calculcation by @​chr-hertel in modelcontextprotocol/php-sdk#313
• chore(deps): bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in modelcontextprotocol/php-sdk#331
• chore(deps): bump actions/download-artifact from 4 to 8 by @​dependabot[bot] in modelcontextprotocol/php-sdk#330
• [Server] Compose StreamableHttpTransport security middleware via defaultMiddleware() factory by @​sveneld in modelcontextprotocol/php-sdk#307
• [Server] Allow runtime-resolved element handlers by @​e0ipso in modelcontextprotocol/php-sdk#294
• [Schema][Server] Add MCP Apps extension (io.modelcontextprotocol/ui) support by @​chr-hertel in modelcontextprotocol/php-sdk#281
• Document v0.6.0 changes in CHANGELOG and docs by @​chr-hertel in modelcontextprotocol/php-sdk#311

Breaking Changes

• Renamed Mcp\Schema\Resource to Mcp\Schema\ResourceDefinition. No alias.
• Renamed Mcp\Capability\Registry\Loader\ArrayLoader to Mcp\Capability\Registry\Loader\ReflectedElementLoader.
• Bump default protocol version to 2025-11-25
• Removed ElementReference::$isManual public property and the bool $isManual parameter from all *Reference constructors. Origin tracking is no longer carried on the element; manual-over-discovered precedence is encoded by loader execution order.
• RegistryInterface::registerTool(), registerResource(), registerResourceTemplate(), registerPrompt() lost their trailing bool $isManual = false parameter. Callers using positional arguments must drop the flag.
• Removed RegistryInterface::clear(), getDiscoveryState(), setDiscoveryState(). Rediscovery now goes through DiscoveryLoader::load() directly.
• Builder::addResource() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• Builder::addResourceTemplate() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• StreamableHttpTransport constructor: $corsHeaders parameter removed; CORS is now configured via CorsMiddleware. The $middleware parameter is nullable — null (or omitted) installs the default stack; [] disables all defaults. Default Access-Control-Allow-Origin is no longer set (was *).
• ResourceDefinition::__construct() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• ResourceTemplate::__construct() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• McpResource and McpResourceTemplate attribute signatures changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.

New Contributors

• @​johnhunt-lc made their first contribution in modelcontextprotocol/php-sdk#292
• @​blackwell-systems made their first contribution in modelcontextprotocol/php-sdk#297
• @​SBNTT made their first contribution in modelcontextprotocol/php-sdk#299
• @​svenmuennich made their first contribution in modelcontextprotocol/php-sdk#300

Full Changelog: modelcontextprotocol/php-sdk@v0.5.0...v0.6.0

Changelog

Sourced from mcp/sdk's changelog.

0.6.0

• Add Builder::add(Tool|ResourceDefinition|ResourceTemplate|Prompt $definition, ElementHandlerInterface $handler) for explicit registration of elements whose schema is only known at runtime.
• Add handler interfaces ToolHandlerInterface, ResourceHandlerInterface, ResourceTemplateHandlerInterface, PromptHandlerInterface, and the ElementHandlerInterface marker.
• [BC Break] Renamed Mcp\Schema\Resource to Mcp\Schema\ResourceDefinition. No alias.
• [BC Break] Renamed Mcp\Capability\Registry\Loader\ArrayLoader to Mcp\Capability\Registry\Loader\ReflectedElementLoader.
• [BC Break] Bump default protocol version to 2025-11-25
• Add support for MCP Apps extension in schema and server
• Add extensions to ServerCapabilities and ClientCapabilities and Builder::enableExtension()
• Allow overriding the default name pattern for Discovery
• Add configurable session garbage collection (gcProbability/gcDivisor)
• Add optional title field to ResourceDefinition and ResourceTemplate for MCP spec compliance
• Add ChainLoader to compose multiple LoaderInterface implementations via explicit ordering.
• Add RegistryInterface::unregisterTool(), unregisterResource(), unregisterResourceTemplate(), unregisterPrompt() — idempotent removals.
• Add RegistryInterface::hasTool(), hasResource(), hasResourceTemplate(), hasPrompt() — by-name existence checks.
• DiscoveryLoader now refreshes only its own previously written entries; manual registrations (via Builder::addTool() etc. or runtime $registry->registerTool() calls) survive rediscovery, and a same-name manual registration takes precedence over discovery on collision.
• [BC Break] Removed ElementReference::$isManual public property and the bool $isManual parameter from all *Reference constructors. Origin tracking is no longer carried on the element; manual-over-discovered precedence is encoded by loader execution order.
• [BC Break] RegistryInterface::registerTool(), registerResource(), registerResourceTemplate(), registerPrompt() lost their trailing bool $isManual = false parameter. Callers using positional arguments must drop the flag.
• [BC Break] Removed RegistryInterface::clear(), getDiscoveryState(), setDiscoveryState(). Rediscovery now goes through DiscoveryLoader::load() directly.
• Registry::register*() semantics changed to plain last-write-wins (overwrites silently) and the methods now return the stored *Reference. The previous "discovered registration is ignored when a manual one already exists" precedence rule still applies, but is now enforced by DiscoveryLoader via reference-identity tracking — and still emits a debug log when a discovery is skipped due to a conflicting registration.
• Add optional title parameter to Builder::addResource() and Builder::addResourceTemplate() for MCP spec compliance
• [BC Break] Builder::addResource() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• [BC Break] Builder::addResourceTemplate() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• Add CorsMiddleware, DnsRebindingProtectionMiddleware, and ProtocolVersionMiddleware for StreamableHttpTransport, composed automatically as the default stack via StreamableHttpTransport::defaultMiddleware()
• [BC BREAK] StreamableHttpTransport constructor: $corsHeaders parameter removed; CORS is now configured via CorsMiddleware. The $middleware parameter is nullable — null (or omitted) installs the default stack; [] disables all defaults. Default Access-Control-Allow-Origin is no longer set (was *).
• [BC Break] ResourceDefinition::__construct() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• [BC Break] ResourceTemplate::__construct() signature changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.
• [BC Break] McpResource and McpResourceTemplate attribute signatures changed — $title parameter added between $name and $description. Callers using positional arguments must switch to named arguments.

Commits

• 433c84b Document v0.6.0 changes in CHANGELOG and docs (#311)
• d150772 [Schema][Server] Add MCP Apps extension (io.modelcontextprotocol/ui) support ...
• 0347dc8 [Server] Allow runtime-resolved element handlers (#294)
• 293a588 [Server] Compose StreamableHttpTransport security middleware via defaultMiddl...
• ee40ff5 chore(deps): bump actions/download-artifact from 4 to 8 (#330)
• d2fc743 chore(deps): bump actions/upload-artifact from 4 to 7 (#331)
• f12ea0a Fix conformance score calculcation (#313)
• 3e45b1f Streamline README and add conformance score badges (#312)
• 1300d2e Add title parameter to Builder::addResource() and addResourceTemplate() (#310)
• a820497 Add title field to Resource and ResourceTemplate (#301)
• Additional commits viewable in compare view