Skip to content

chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.4.0 to 1.4.1 - #36

Merged
suisuss merged 1 commit into
mainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.1
Jul 29, 2026
Merged

chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.4.0 to 1.4.1#36
suisuss merged 1 commit into
mainfrom
dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 25, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/modelcontextprotocol/go-sdk from 1.4.0 to 1.4.1.

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.4.1

This release is a patch release for v1.4.0.

It contains cherry-picks for several security improvements. Security advisories will follow.

Fixes

Update of the segmentio/encoding module version

The JSON parsing library that was adopted to avoid attacks taking advantage of the Go's standard parser being case insensitive turned out to contain an issue itself. We have submitted the fix upstream and this release updates the dependency to the patched version.

Cross-origin requests protection

We have added additional protection against cross origin requests. From now on, we verify that Content-Type for JSON-RPC POST requests is set to application/json and use the new http.CrossOriginProtection functionality to verify the origin of the request. Usage of this functionality required increasing the required Go version to 1.25, which is in line with our Go version policy of supporting two newest Go versions. The behavior can be customized by passing a configured http.CrossOriginProtection object to StreamableHTTPOptions.

Since this is a behavior change, we introduced a compatibility parameter disablecrossoriginprotection that will allow to temporarily disable it. It will be removed in v1.6.0 version of the SDK. See here for more details about behavior changes and a history of compatibility parameters across SDK versions.

Allowing customization of http.Client for client-side OAuth

We have introduced an optional http.Client parameter to AuthorizationCodeHandlerConfig. This allows customization of the transport, for example implementing environment specific protection against Server-Side Request Forgery.

Pull requests

Full Changelog: modelcontextprotocol/go-sdk@v1.4.0...v1.4.1

Commits
  • 580f2a0 mcp: verify 'Origin' and 'Content-Type' headers (#842)
  • 421ddf1 auth: allow passing custom http.Client to AuthorizationCodeHandler (#840)
  • 515f11b internal: fix Unicode zero character handling (#841)
  • See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 25, 2026
suisuss added a commit that referenced this pull request Jul 29, 2026
…g go.sum (#82)

generate.go carries //go:build ignore, so go mod tidy never sees its import
of github.com/spf13/cobra/doc and prunes go-md2man and blackfriday from
go.sum. Doc generation then fails with a missing go.sum entry. Dependabot
runs tidy on every bump, so this broke docs-check on PRs #36, #37 and #81.

Add a tools-tagged blank import. go mod tidy evaluates imports under all
build tag combinations, unlike the compiler, so the tag keeps the file out
of every real build while holding those hashes pinned. Verified: tidy now
leaves go.sum untouched, and go list -deps ./cmd/kh has no md2man.

Also promote golang.org/x/crypto out of the indirect block: cmd/read/read.go
imports it directly, so go.mod was not tidy-clean and any tidy run moved it.
@suisuss

suisuss commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

Bumps [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) from 1.4.0 to 1.4.1.
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.4.0...v1.4.1)

---
updated-dependencies:
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.1 branch from 672c802 to 449dfe8 Compare July 29, 2026 01:47
@suisuss
suisuss merged commit 3e22138 into main Jul 29, 2026
4 checks passed
@suisuss
suisuss deleted the dependabot/go_modules/github.com/modelcontextprotocol/go-sdk-1.4.1 branch July 29, 2026 01:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant