fix(deps): update mcp to v0.13.0 by renovate[bot] · Pull Request #19 · ptitjes/konvo

renovate · 2026-04-03T13:27:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
io.modelcontextprotocol:kotlin-sdk	`0.11.0` → `0.13.0`

Release Notes

modelcontextprotocol/kotlin-sdk (io.modelcontextprotocol:kotlin-sdk)

`v0.13.0`

Compare Source

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @devcrocod in #732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @devcrocod in #778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #573, #574, #708).

DNS rebinding protection enabled by default by @devcrocod in #659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @devcrocod in #732
Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @devcrocod in #778

Fixed

Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @jskjw157 in #738

Security

Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @devcrocod in #659
Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @devcrocod in 6e6f805

Maintenance

Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @devcrocod in #754

Dependencies

Ktor to v3.4.3 in #785
kotlinx.coroutines to v1.11.0 in #760
kotlin-logging to v8.0.03 in #752, #783
24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: modelcontextprotocol/kotlin-sdk@0.12.0...0.13.0

`v0.12.0`

Compare Source

Description

Adds sampling-with-tools per SEP-1577, JSON Schema dialect declaration on tool schemas, server-side tool name validation, and capability extensions; fixes SSE reconnect on the same session and stops swallowing CancellationException.

Breaking Changes

Sampling messages can carry tool calls and results (SEP-1577) by @devcrocod in #718

SamplingMessage.content is now typed as a new SamplingMessageContent supertype, with MediaContent (text/image/audio), ToolUseContent, and ToolResultContent as variants. MediaContent still exists and now extends SamplingMessageContent, so most source code that constructs sampling messages compiles unchanged — but the binary signatures of SamplingMessage, CreateMessageResult, and related types have changed. ClientCapabilities.sampling is also now a typed Sampling object instead of a raw JsonObject. Recompilation is required; consumers reading sampling as JsonObject must migrate to the typed accessors.

watchosX64 and tvosX64 Kotlin/Native targets removed by @devcrocod in #727

These targets have been deprecated upstream. Migrate to the corresponding ARM/simulator targets (watchosArm64, watchosSimulatorArm64, tvosArm64, tvosSimulatorArm64).

Features

Add $schema field to ToolSchema, declaring JSON Schema 2020-12 as the default dialect (SEP-1613) by @devcrocod in #696
Validate tool names at registration time on the server, following the MCP tool naming standard (SEP-986) by @devcrocod in #695
Add extensions field to ClientCapabilities and ServerCapabilities for advertising supported MCP extensions during the initialize handshake by @eritscher in #678

Fixed

Validate the mcp-protocol-version HTTP header on initialization requests and correct DEFAULT_NEGOTIATED_PROTOCOL_VERSION to match the spec by @devcrocod in #697
Propagate CancellationException instead of logging it as an error by @devcrocod in #706
Evict stale GET SSE stream mapping on reconnect so a new GET on the same session is no longer silently rejected by the leftover entry from the previous stream by @amr in #716

Maintenance

Add kotlinlang MCP server sample with search and get_page tools by @devcrocod in #713
Migrate detekt to a buildSrc convention plugin with a fully explicit, version-locked YAML config by @devcrocod in #729
Add Streamable HTTP integration tests for pagination, bad-request handling, and logging by @jskjw157 in #613
Remove unused OpenAPI Generator plugin and configuration by @devcrocod in #683
Remove Codecov configuration in favor of kover by @devcrocod in #691
Remove redundant JUnit XML report configuration by @devcrocod in #728
Remove IDEA files tied to the incompatible detekt IDE plugin by @devcrocod in #714
Add Node.js setup to the release workflow so TypeScript integration tests run on macOS runners by @devcrocod in #684

Dependencies

Kotlin to v2.3.21 in #704, #723
kotlinx.serialization-json to v1.11.0 in #687

New Contributors

@eritscher made their first contribution in #678
@amr made their first contribution in #716

Full Changelog: modelcontextprotocol/kotlin-sdk@0.11.1...0.12.0

`v0.11.1`

Compare Source

Description

Fixes an SSE stream crash on Netty when clients connect to the Streamable HTTP GET endpoint.

Fixed

Fixed GET SSE stream crash on Netty in Streamable HTTP where appendSseHeaders() was called after response headers were already committed, causing UnsupportedOperationException and client retry loops by @devcrocod in #681

Dependencies

mcp-kotlin to v0.11.0 in #672, #673, #675, #676
Ktor BOM to v3.3.3 in #650, #653, #656
Kotest assertions to v6.1.11 in #674
anthropic-java to v2.19.0 in #671
@modelcontextprotocol/sdk to v1.29.0, @types/node update in #677
hono to v4.12.12 in #680
@hono/node-server to v1.19.13 in #679

Full Changelog: modelcontextprotocol/kotlin-sdk@0.11.0...0.11.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-04-03T13:31:48Z