Skip to content

Bump github.com/modelcontextprotocol/go-sdk from 1.2.0 to 1.4.1 - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.1
Open

Bump github.com/modelcontextprotocol/go-sdk from 1.2.0 to 1.4.1#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 19, 2026

Copy link
Copy Markdown

Bumps github.com/modelcontextprotocol/go-sdk from 1.2.0 to 1.4.1.

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.4.1

This release is a patch release for v1.4.0.

It contains cherry-picks for several security improvements. Security advisories will follow.

Fixes

Update of the segmentio/encoding module version

The JSON parsing library that was adopted to avoid attacks taking advantage of the Go's standard parser being case insensitive turned out to contain an issue itself. We have submitted the fix upstream and this release updates the dependency to the patched version.

Cross-origin requests protection

We have added additional protection against cross origin requests. From now on, we verify that Content-Type for JSON-RPC POST requests is set to application/json and use the new http.CrossOriginProtection functionality to verify the origin of the request. Usage of this functionality required increasing the required Go version to 1.25, which is in line with our Go version policy of supporting two newest Go versions. The behavior can be customized by passing a configured http.CrossOriginProtection object to StreamableHTTPOptions.

Since this is a behavior change, we introduced a compatibility parameter disablecrossoriginprotection that will allow to temporarily disable it. It will be removed in v1.6.0 version of the SDK. See here for more details about behavior changes and a history of compatibility parameters across SDK versions.

Allowing customization of http.Client for client-side OAuth

We have introduced an optional http.Client parameter to AuthorizationCodeHandlerConfig. This allows customization of the transport, for example implementing environment specific protection against Server-Side Request Forgery.

Pull requests

Full Changelog: modelcontextprotocol/go-sdk@v1.4.0...v1.4.1

v1.4.0

This release marks the completion of the full 2025-11-25 specification implementation, by introducing the support for Sampling with Tools and experimental client-side OAuth support. It also contains multiple bug fixes and improvements. Thanks to all contributors!

Client-side OAuth support

This release introduces experimental support for OAuth on the client side of the SDK. It aims to support the full scope of the current MCP specification for authorization. To use it, you need to compile the SDK with the -tags mcp_go_client_oauth flag. Some changes may still be applied to this new API, based on developer feedback. The functionality is planned to become stable in v1.5.0 release, expected by the end of March 2026. More details can be found at https://github.com/modelcontextprotocol/go-sdk/blob/main/docs/protocol.md#client.

Sampling with Tools

Starting from this release, the server use the new CreateMessageWithTools method to create a sampling request to the client that contains tools that can be used by the client. On the client side, CreateMessageWithToolsHandler may be used to handle such requests and issue ToolUse responses to the server.

Behavior changes

We have two important behavior changes that were introduced to fix a bug or improve security posture. They can be temporarily turned off by specifying a special MCPGODEBUG environment variable when running the SDK. Different options can be added together, separated by a comma.

Introduced DNS rebinding protection

The requests arriving via a localhost address (127.0.0.1, [::1]) that have a non-localhost Host header will be rejected to protect against DNS rebinding attacks. The protection can be disabled by specifying StreamableHTTPOptions.DisableLocalhostProtection, but it should be done only if security implications are understood (see documentation for the option).

This protection is a behavior change, as the protection is now enabled by default. Because of that, we have introduced an MCPGODEBUG option to bring back the previous default behavior for users that need more time to adjust. However, if possible, we recommend specifying DisableLocalhostProtection described above, as it is a more future-proof solution. The MCPGODEBUG option to remove this protection (disablelocalhostprotection=1) will be removed in v1.6.0.

... (truncated)

Commits
  • 580f2a0 mcp: verify 'Origin' and 'Content-Type' headers (#842)
  • 421ddf1 auth: allow passing custom http.Client to AuthorizationCodeHandler (#840)
  • 515f11b internal: fix Unicode zero character handling (#841)
  • c9317fb all: client side OAuth support (#785)
  • 4e8b6ca mcp: return 400 instead of 500 when body read fails in stateless mode (#817)
  • 0048a18 chore: Configure advanced CodeQL setup (#819)
  • 1942036 chore: update the version of the conformance suite. (#814)
  • b17143f chore: increase timeout for conformance server start. (#813)
  • 86d05a1 chore: update publish-docs permissions to be more targeted. (#812)
  • 9f22cf1 chore: configure a simple AGENTS.md file and a skill for fixing GitHu… (#810)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump github.com/modelcontextprotocol/go-sdk from 1.2.0 to 1.4.1
deff54a 
Bumps [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) from 1.2.0 to 1.4.1.
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.2.0...v1.4.1)

---
updated-dependencies:
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 19, 2026
@dependabot dependabot Bot mentioned this pull request Mar 19, 2026
Closed
Kay9Zero added a commit to Kay9Zero/xk6-infobip-mcp that referenced this pull request Sep 17, 2026
@Kay9Zero
deps: upgrade k6 to v1.8.1 and refresh dependencies
7073f2d 
Move to the current k6 v1 release and refresh the rest of the
dependency set. This also resolves the open Dependabot proposals, in
several cases with newer versions than were proposed:

    go.k6.io/k6                        v1.3.0 -> v1.8.1
    modelcontextprotocol/go-sdk        v1.2.0 -> v1.8.0   (infobip#10)
    google.golang.org/grpc            v1.75.0 -> v1.83.2  (infobip#9)
    go.opentelemetry.io/otel           v1.37.0 -> v1.44.0 (infobip#11, infobip#12, infobip#13)
    sirupsen/logrus                     v1.9.3 -> v1.10.2
    stretchr/testify                   v1.11.1 -> v1.12.1

Two of these are load bearing rather than routine.

grpc is pinned explicitly because k6 v1.8.1 selects v1.82.1, which
govulncheck reports as affected by GO-2026-6348 (heap exhaustion via
HTTP/2 DATA frame fragmentation, fixed in v1.83.1). The vulnerability is
reachable from this extension: the reported trace runs through
RoundTripper.RoundTrip in roundtripper.go. Pinning v1.83.2 clears the
scan.

The go-sdk upgrade fixes an indefinite hang. On v1.2.0, NewClient never
returns when the endpoint accepts the connection but never responds, on
either transport, so a VU pointed at an unresponsive MCP server wedges
for the remainder of the test run. v1.8.0 hardens the transports and
honours cancellation.

sobek is pinned to the revision k6 v1.8.1 itself requires rather than a
newer one, and OpenTelemetry is kept on the coordinated 1.44.0 family,
to avoid overriding transitive versions k6 was tested against.

The Go directive moves to 1.25.0 with toolchain go1.25.12, matching what
k6 v1.8.1 declares.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants