fix(deps): update all major dependencies (major) - #7
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/major-all-major-dependencies
branch
2 times, most recently
from
July 21, 2026 18:07
62ff632 to
0663b43
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/major-all-major-dependencies
branch
from
July 29, 2026 15:56
0663b43 to
bb24fef
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6→v7v6→v7v8.1.0→v9.0.0>=1.0.0,<2.0.0→>=2.0.0,<2.1.0>=1.13.1,<2.0.0→>=2.0.0,<2.1.0Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
v7Compare Source
astral-sh/setup-uv (astral-sh/setup-uv)
v9.0.0Compare Source
v8.3.2Compare Source
v8.3.1Compare Source
v8.3.0Compare Source
v8.2.0: 🌈 New inputsquietanddownload-from-astral-mirrorCompare Source
Changes
This release brings two new inputs and a few bug fixes.
New inputs
Lets talk about the new inputs first.
quiet
Pretty simple. It turns of all
infologgings. Useful if you use this in a composite action and are not interested in all the details.In the upcoming releases we will add log groups to fully implement support for "less noise"
download-from-astral-mirror
In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting
download-from-astral-mirror: falseallows you to do that.Bugfixes
When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.
We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.
🐛 Bug fixes
🚀 Enhancements
download-from-astral-mirrorinput @eifinger (#897)🧰 Maintenance
⬆️ Dependency updates
modelcontextprotocol/python-sdk (mcp)
v2.0.0Compare Source
MCP Python SDK v2 Stable Release
This is v2.0.0, the stable v2 release of the MCP Python SDK. It supports the 2026-07-28 revision of the Model Context Protocol and serves every earlier revision from the same server.
pip install mcpnow installs 2.x.Documentation Rewrite
The documentation has the full tutorial and API reference. Coming from v1? What's new in v2 is the tour of what changed and why, and the migration guide lists every breaking change with before-and-after code.
V1 Maintenance mode
v1.x is in maintenance mode and will only receive security fixes from now on The 1.x line lives on the
v1.xbranch, continues to receive critical bug fixes and security patches, and is documented at https://py.sdk.modelcontextprotocol.io/v1/. If your project is not ready to migrate, keep a<2upper bound on your requirement (for examplemcp>=1.28,<2).Highlights
One SDK, both protocol eras
v2 speaks the 2026-07-28 revision (stateless requests with no handshake,
server/discover,subscriptions/listen, multi-round-trip requests) and still serves every 2025-era client from the sameMCPServer, over Streamable HTTP and stdio, with nothing to configure.Client(target)negotiates the version automatically.FastMCPis nowMCPServer, and there is a first-classClientThe decorator API is unchanged; the low-level
Serveris rebuilt around a shared dispatcher engine, and oneClientobject replaces v1's transport-plus-ClientSession-plus-initialize()layering. It connects to a URL, a stdio subprocess, a custom transport, or straight to a server object in memory for tests.Multi-round-trip requests and resolver dependency injection
At 2026-07-28 the server can no longer call the client, so tools return the question instead. A
Resolve(fn)parameter is filled by your function invisibly to the model and can put a question to the user; one tool body serves both eras.Extension APIs, OpenTelemetry, and a standalone types package
Servers and clients compose protocol extensions through pluggable extension APIs (MCP Apps built in); OpenTelemetry tracing ships on by default; every protocol type is its own package,
mcp-types(imported asmcp_types), published in lock-step withmcp.Hardened stdio and auth
stdio servers keep handler subprocesses and stray prints off the wire, and stdout is diverted to stderr while serving. OAuth adds RFC 9207 issuer validation, the SEP-990 identity-assertion flow, and the client-credentials extension.
Coming from a v2 pre-release
Since the last release candidate: the per-version wire packages are private (
mcp_types._v*),mcp.typesis a permanent alias formcp_types, the auth registration request model is split from the registered-client record, cancelled requests are no longer answered, and log notifications are gated on the per-request log-level opt-in at 2026-07-28. Since the betas:Client(cache=False)is nowcache=NonewithCacheConfig()the default;Context.client_id,RFC7523OAuthClientProvider, andOAuthClientProvider(timeout=)are removed; the client-credentials providers takescope=;message_handlerreceives notifications and exceptions only;FileResource(is_binary=)becomesencoding;MCP_*env vars are gone withpydantic-settings; Streamable HTTP servers reject bodies over 4 MiB with HTTP 413. The migration guide covers all of it.Known gaps
The tasks extension (SEP-2663) is not part of this release. On the client, the DPoP proof binding (SEP-1932) and the workload-identity
jwt-bearergrant are not implemented; both are additive and can land in 2.x.Feedback
Something rough, confusing, or broken? Open an issue or find us in #python-sdk-dev on the MCP Contributors Discord.
Full Changelog: modelcontextprotocol/python-sdk@v2.0.0rc1...v2.0.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.