v0.26.2
Changed
-
[drf-mcp]→djangorestframework-mcp-server>=0.17,<0.20, so 0.19.0 is
installable. That release fixes dynamic client registration, which issued
credentials that could never authenticate:token_endpoint_auth_methodwas
not modelled, so every registration silently became a confidential client, and
theclient_secrethanded back was the stored PBKDF2 digest rather than the
secret. Both are confined to drf-mcp'scontrib.oauth— the bridge this
extra backs consumesMCPServer, which did not change, so the widening is
purely a ceiling lift and this transport's own behaviour is unaffected.Verified rather than assumed: the suite runs green against 0.19.0 with the
lock updated.