v1.4.2

This patch release includes security fixes for OAuth authentication and authenticated HTTP sessions.

What's Changed

• Validate OAuth PKCE support and metadata issuer #1949 by @halter73 (co-authored by @PranavSenthilnathan @Copilot)

Deployments using metadata-free 2025-03-26 OAuth discovery may explicitly enable the legacy endpoint fallback only after independently verifying PKCE enforcement; otherwise, update metadata to advertise S256. The process-wide opt-in is ModelContextProtocol.Authentication.AllowLegacyOAuthMetadataFallback; it does not bypass validation of discovered metadata.

• Harden authenticated HTTP session handling (7c5d15e) by @halter73 (co-authored by @jeffhandley @PranavSenthilnathan @Copilot)

Documentation Updates

• Sanitize 1.x documentation #1729 by @jeffhandley
• Document standing support for new MCP revisions #1827 by @jeffhandley (co-authored by @halter73 @Copilot)

Repository Infrastructure Updates

• Update SourceLink for 1.x documentation builds #1944 by @jeffhandley (co-authored by @Copilot)
• Enable CodeQL for release branches #1947 by @halter73 (co-authored by @Copilot)
• Add versioned docs publishing infrastructure #1980 by @jeffhandley (co-authored by @Copilot)
• Fix Markdown link-check warnings and outdated Skills specification link #1978 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

• @halter73 @jeffhandley @PranavSenthilnathan @tarekgh reviewed pull requests

Full Changelog: v1.4.1...v1.4.2

Note

These release notes were drafted with GitHub Copilot.