v0.26.3

Changed

• [drf-mcp] → djangorestframework-mcp-server>=0.17,<0.22, taking in both
  0.20.0 and 0.21.0. Two consumer-reported blockers, neither of which touches
  this transport:

  • 0.21.0 — DjangoOAuthToolkitBackend rejected every bearer token once a
    resource URL was configured. Audience enforcement read a resource field
    that DOT's AccessToken does not have, so it could never succeed;
    enforcement is now the separate ENFORCE_AUDIENCE, default off.
  • 0.20.0 — dynamically registered clients could not be issued an ID token
    (Application.algorithm was never set), so the token endpoint 500'd whenever
    the advertised openid scope was requested.

  Both are confined to drf-mcp's OAuth surface. The bridge consumes MCPServer
  in-process and never constructs an auth backend, so no adaptation was needed —
  verified with the lock updated to 0.21.0 and the suite green.

  0.20.0 also added UndescribedToolWarning, which the bridge fixtures trip by
  registering throwaway tools; filtered in pyproject.toml.