Skip to content

build(deps): bump mcp/sdk from 0.7.1 to 0.8.0 - #373

Merged
mglaman merged 1 commit into
mainfrom
dependabot/composer/mcp/sdk-0.8.0
Aug 31, 2026
Merged

build(deps): bump mcp/sdk from 0.7.1 to 0.8.0#373
mglaman merged 1 commit into
mainfrom
dependabot/composer/mcp/sdk-0.8.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps mcp/sdk from 0.7.1 to 0.8.0.

Release notes

Sourced from mcp/sdk's releases.

v0.8.0

2026-07-28 Support incl. Stateless HTTP Transport

With v0.8.0 we are shipping support for the 2026-07-28 Model Context Protocol specification, which includes a major rework on HTTP transport going stateless, while keeping older versions of the specifications alive and mostly compatible in userland code. Find a detailed CHANGELOG in the repository, and per PR below.

What's Changed

... (truncated)

Changelog

Sourced from mcp/sdk's changelog.

0.8.0

  • Support for MCP spec version 2026-07-28 incl. stateless HTTP transport
    • Negotiate the protocol revision during initialize: the server counter-offers a revision it supports and the client fails the handshake instead of continuing on an unagreed one. Adds Client::getProtocolVersion().
    • Serve both protocol eras from one endpoint: StreamableHttpTransport classifies each request (InboundClassifier) and routes it to the matching dispatcher, so one URL answers modern and handshake-era clients alike. Builder::withoutModernEra() opts out, Builder::setModernVersions() narrows the modern leg.
    • Speak the lifecycle from the client: Client opens with server/discover, stamps _meta with version, capabilities and client info, and sends the Mcp-Method/Mcp-Name/Mcp-Param-* headers (via Client\Stateless\ToolCatalog). Schema\Wire\McpHeader holds the shared header names.
    • Add multi round-trip requests (SEP-2322): a handler returning InputRequiredResult yields resultType: "input_required" with an opaque, signed requestState (RequestStateCodec, key via Builder::setRequestState()); the client retries with inputResponses, read through RequestContext::getInputContext() and its typed elicitResult()/samplingResult()/rootsResult(). On the client, InputRequestResolver answers such results automatically from the host's elicitation, sampling and roots handlers.
    • Serve ClientGateway::elicit()/elicitUrl() on every revision: where the client cannot be asked mid-request, Server\Stateless\ElicitationReplay turns the ask into input_required and resumes once re-sent — the handler is entered once per ask. InputRequiredShim does the reverse for handshake-era clients. sample()/listRoots() raise a LogicException on 2026-07-28, which removed them.
    • Run stateless handlers in a fiber so $gateway->progress()/log() stream over SSE when the handler emits something and the client accepts text/event-stream; honour io.modelcontextprotocol/logLevel (SEP-2575). Adds LoggingLevel::severity()/isAtLeast().
    • Deliver notifications on subscriptions/listen (SEP-2575) via NotificationBusInterface — InMemoryNotificationBus for persistent runtimes, Psr16NotificationBus for PHP-FPM — set with Builder::setNotificationBus(); Builder::setSubscriptionLifetime() replaces the hard-coded 30s ceiling.
    • Validate the standard request headers (SEP-2243) with StandardHeaderValidator (Builder::setHeaderValidator()), answering -32020 when they contradict the body.
    • Add Wire\CachePolicy (Builder::setCachePolicy()) for SEP-2549 caching hints; defaults to ttlMs: 0, cacheScope: private. A ReadResourceResult may override with its own values.
    • Carry W3C trace context (SEP-414): traceparent/tracestate/baggage from _meta are exposed via RequestContext::getTraceContext() and echoed onto the request's notifications.
    • Close the schema gaps for 2025-06-18/2025-11-25 and add the 2026-07-28 surface (SEP-2106): url-mode elicitation (ClientGateway::elicitUrl()/supportsElicitationUrl()), Implementation::title, and outputSchema/structuredContent accepting any JSON value.
    • Deprecate Roots, Sampling and Logging (SEP-2577, earliest removal 2027-07-28); they keep working but trigger a deprecation notice.
    • [BC Break] Answer a not-found subject with -32602 instead of -32002 (SEP-2164): resources/read picks the code by revision (-32602 from 2026-07-28 on), prompts/get, completion/complete and tools/call switch on every revision. Adds ProtocolVersion::usesInvalidParamsForResourceNotFound().
    • [BC Break] A list-shaped tool result is only sent as structuredContent on 2026-07-28+; older revisions keep the JSON-encoded value in content.
  • [BC Break] Add the extensions framework (SEP-2133) MCP Apps sits on: ExtensionInterface::getId() returns an ExtensionIdentifier value object, and the interface gains getMessages()/getRequestHandlers() (extend AbstractExtension to skip both). MessageFactory::make() takes an $additional message list; RequestHandlerInterface's result template is covariant. ServerExtensionInterface is replaced by the side-agnostic Schema\Extension\ExtensionInterface.
  • Add client-side extension negotiation: ClientGateway::supportsExtension(), Client\Builder::enableExtension(), ClientCapabilities::withExtensions().
  • Add sampling-with-tools: sampling requests can carry tools and tool-choice preferences, messages support tool-use/tool-result blocks, and clients advertise sampling.context/sampling.tools (ClientGateway::supportsSamplingTools()/supportsSamplingContext()). Requests violating the tool-flow rules are rejected with a JSON-RPC error.
  • [BC Break] SamplingMessage::$content and CreateSamplingMessageResult::$content may be a list of content blocks — use getContentBlocks(). CreateSamplingMessageResult rejects roles other than assistant and empty content.
  • Add client-side Roots support (RootsCallbackInterface, Client::sendRootsListChanged()) and server-side ClientGateway::listRoots()/supportsRoots()/supportsSampling().
  • Add Schema\Content\ResourceLink to reference a resource by URI in tool results and prompt messages.
  • [BC Break] Schema\JsonRpc\Error accepts null as $id; an unreadable id now omits the member instead of sending "id": "". MessageFactory decodes a missing or null id as an id-less error.
  • Preserve the request id on an invalid-but-parseable message (-32600) via InvalidInputMessageException::getRequestId().
  • [BC Break] Drop the SDK-only name pattern on ResourceDefinition/ResourceTemplate $name; the spec allows any string.
  • Log expected tool failures (ToolCallException) at debug level instead of error.
  • Add annotations to ImageContent.
  • Fix empty tool/resource schemas serializing as [] instead of {}.
  • Fix PromptResultFormatter dropping annotations, _meta and mimeType for plain-array content.

0.7.0

  • Add client-side elicitation support: ElicitationCallbackInterface, ElicitationRequestHandler, and ElicitationException let clients respond to server elicitation requests.
  • Defer element loading to the first registry read: loaders now run at request time (first has*/get* call) instead of eagerly at Builder::build(), fixing empty registries under persistent runtimes (e.g. FrankenPHP worker mode) where a loader's data source is not ready at build time. Adds Builder::setLazyLoading() (default on), a public Registry::load(), and an optional LoaderInterface constructor argument on Registry.
  • [BC Break] Element loading is lazy by default: loader failures now surface on the first request rather than at Builder::build(), and initialize advertises capabilities from the configured sources rather than the loaded registry. Call Builder::setLazyLoading(false) to restore eager build-time loading.
  • Allow [$instance, 'methodName'] as an element handler in Builder::addTool(), addResource(), addResourceTemplate(), and addPrompt(). Unblocks handlers with constructor dependencies that the container-less new $className() fallback cannot build.
  • Always emit an items schema for array tool parameters: untyped arrays get items: {} and nullable typed arrays (e.g. string[]|null) keep their element type. Fixes strict clients rejecting tools with "array type must have items" (#151).
  • Harden JSON-RPC input parsing: single-message vs batch is now decided from the decoded JSON type (object → single, list array → batch) instead of the raw first byte. Scalars, empty payloads, and non-object batch elements are surfaced as InvalidInputMessageException entries instead of triggering warnings or a TypeError.
  • Add maxBatchSize (default 100) to MessageFactory — oversized JSON-RPC batches are rejected before any message is constructed, guarding against amplification.
  • Add maxBodyBytes (default 4 MiB) to StreamableHttpTransport — POST bodies exceeding the cap are rejected with 413. Unknown-size/chunked bodies are read incrementally and stopped at the cap so they cannot exhaust memory.
  • Reject malformed Mcp-Session-Id headers with a 400 response: a repeated header or a value that is not a valid UUID is now rejected up front instead of surfacing as an uncaught Uuid::fromString() error.
  • Extract RFC 9728 metadata serving into ProtectedResourceMetadataHandler, a transport-neutral PSR-15 RequestHandlerInterface that can be mounted directly as a Symfony/Laravel controller; ProtectedResourceMetadataMiddleware now delegates to it (no BC break).

0.6.0

  • Add Builder::add(Tool|ResourceDefinition|ResourceTemplate|Prompt $definition, ElementHandlerInterface $handler) for explicit registration of elements whose schema is only known at runtime.

... (truncated)

Commits
  • e173367 [Server] Keep injectable parameters out of the published inputSchema (#482)
  • ff0b5fa [Capability] Extract shared element name/description resolution (#481)
  • 312c621 [Capability] Suppress list-changed events during the initial registry load (#...
  • c36e805 [Server] Restrict FileSessionStore::gc() to owned session files (#479)
  • d59950f [Server][Client] Bridge W3C trace context between HTTP headers and _meta (SEP...
  • 1e9520e [Docs] Deprecation policy, SDK tier target, and CONTRIBUTING.md (#472)
  • d09fe30 [Server] Make resource subscribe/unsubscribe errors protocol-version-aware (S...
  • 32464ec [Changelog] Restructure 0.8.0 section (#478)
  • c882401 [Server] Log failures in CompletionCompleteHandler (#471)
  • b1c7272 [Server] Lower expected tool failure logging (#433)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump mcp/sdk from 0.7.1 to 0.8.0
7cb271e 
Bumps [mcp/sdk](https://github.com/modelcontextprotocol/php-sdk) from 0.7.1 to 0.8.0.
- [Release notes](https://github.com/modelcontextprotocol/php-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/php-sdk/blob/main/CHANGELOG.md)
- [Commits](modelcontextprotocol/php-sdk@v0.7.1...v0.8.0)

---
updated-dependencies:
- dependency-name: mcp/sdk
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Aug 31, 2026
@mglaman
mglaman merged commit 9cd7230 into main Aug 31, 2026
9 checks passed
@dependabot
dependabot Bot deleted the dependabot/composer/mcp/sdk-0.8.0 branch August 31, 2026 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mglaman