v2.6.0

What's Changed

• chore(deps): update dependency @fastify/cors to v11.3.1 by @renovate[bot] in #218
• fix(auth): advertise required scopes in resource metadata and 401 challenge by @mcollina in #227
• chore(deps): update dependency @fastify/jwt to v10.2.4 by @renovate[bot] in #247
• chore(deps): update dependency @fastify/pre-commit to v2.2.2 by @renovate[bot] in #248
• fix(stdio): send the negotiated protocol version on later requests by @mcollina in #228
• fix(sse): only deliver resources/updated to subscribed sessions by @mcollina in #246
• fix(redis): handle connection errors instead of crashing the process by @mcollina in #243
• fix(elicitation): honor client capability and accept client responses by @mcollina in #241
• fix(prompts): return JSON-RPC errors for prompt and resource failures by @mcollina in #235
• feat(auth): add authorization.protectedRoutes to scope auth to /mcp by @mcollina in #233
• fix(tasks): validate the client-requested task ttl by @mcollina in #231
• fix(tasks): rely on Redis expiry in RedisTaskStore.get() by @mcollina in #225
• feat(auth): support scope hierarchies via authorization.scopeImplies by @mcollina in #229
• fix(stdio): wait for app.close() before runStdioServer resolves by @mcollina in #238
• fix(auth): include error="invalid_token" in 401 WWW-Authenticate challenge by @mcollina in #236
• fix(auth): build resource_metadata URL per RFC 9728 when resourceUri has a path by @mcollina in #232
• fix(routes): answer body-parser errors on POST /mcp with JSON-RPC errors by @mcollina in #230
• fix(auth): bind sessions to token subject, constrain JWT issuer, read templated resources by @mcollina in #245
• fix(tasks): paginate tasks/list and index Redis tasks per owner by @mcollina in #239
• fix(routes): manage Streamable HTTP sessions without SSE by @mcollina in #242
• fix(tasks): release blocked tasks/result on disconnect and shutdown by @mcollina in #283
• fix(routes): catch rejections in broker-driven SSE delivery by @mcollina in #294
• fix(handlers): list only spec fields for resources and templates by @mcollina in #288
• fix(types)!: remove unused sessionStore/messageBroker options, export AllowedOrigins by @mcollina in #277
• fix(handlers): use spec error codes for unknown prompts, tools and resources by @mcollina in #278
• fix(auth): match the Bearer auth-scheme case-insensitively by @mcollina in #280
• test: expect -32002 for template reads that match nothing by @mcollina in #297
• fix(stdio): do not create SSE sessions for stdio requests by @mcollina in #282
• fix(auth)!: remove /.well-known/openid-configuration/mcp route by @mcollina in #284
• fix(auth): scope well-known CORS to /.well-known/* only by @mcollina in #285
• fix(routes): answer non-message POST /mcp bodies with 400 Invalid Request by @mcollina in #286
• fix(types): make README examples type-check by @mcollina in #287
• fix(tasks): cap tasks retained per caller and evict finished ones first by @mcollina in #289
• fix: reject numeric request ids that are not safe integers by @mcollina in #290
• fix(auth): report why a JWT was rejected instead of "No token validation method configured" by @mcollina in #291
• fix: stop advertising the completions capability by @mcollina in #293
• docs: remove nonexistent mcpSendToUser and tokenRefreshService by @mcollina in #272
• docs: list the real well-known routes by @mcollina in #273
• fix(security): make tool argument limits configurable by @mcollina in #276
• fix(sse): close GET /mcp streams when the opening token expires by @mcollina in #279
• fix(tasks): fail tasks whose running instance stopped renewing its lease by @mcollina in #292
• fix(security): reject invalid allowedOrigins at registration by @mcollina in #274
• fix(stdio): remove SIGINT/SIGTERM listeners on stop by @mcollina in #275
• fix(tasks): bind tasks to token issuer as well as subject by @mcollina in #296
• chore(deps): update dependency @modelcontextprotocol/sdk to v1.32.1 by @renovate[bot] in #321
• fix(example): prevent path traversal in file-listing server by @mcollina in #315
• chore(deps): update dependency @fastify/jwt to v10.2.5 by @renovate[bot] in #331
• chore(deps): update dependency @types/node to v24.19.2 by @renovate[bot] in #332
• chore(deps): update dependency @modelcontextprotocol/sdk to v1.32.2 by @renovate[bot] in #376
• chore(deps): update dependency fastify-plugin to v6.0.1 by @renovate[bot] in #377
• chore(deps): update dependency undici to v7.30.1 by @renovate[bot] in #385
• chore(deps): update dependency @fastify/type-provider-typebox to v6.3.0 by @renovate[bot] in #386

Full Changelog: v2.5.3...v2.6.0