v1.9.1

1.9.1 (2026-09-30)

Bug Fixes

• auth: form the 401 challenge's resource_metadata from the configured resource, so it is right behind a TLS-terminating proxy (548a107)
• auth: ignore a trailing slash on baseUrl instead of advertising endpoints and a resource that do not exist (7935452)
• auth: infer application_type native for a client that redirects to IPv6 loopback (d43dab0)
• auth: persist a DCR client before caching it, so a failed write leaves nothing behind (7f3d214)
• auth: refuse an IPv4 address written inside an IPv6 literal in the CIMD SSRF guard (4aba455)
• auth: require S256 PKCE from Client ID Metadata Document clients, which hold no secret (36f4139)
• edge: cap request bodies on the MCP endpoint at maxBodySize, as the Node transport does (8b4d9cd)
• edge: convert Valibot tool schemas, and leave out a tool whose schema cannot be advertised instead of failing tools/list for all of them (4cfa59b)
• give tools without parameters and prompts without arguments a working context, not the SDK's as their arguments (b24ae84)
• http: send every Set-Cookie header a route sets, instead of only the last (d26d3b6)
• keep the uri a resource loader returns when embedding it, as resources/read does (3f3c30b)
• openapi: follow a path item declared by $ref instead of dropping its operations (9e02024)
• openapi: keep a request body that declares no properties whole, so a dictionary with an empty properties map can be sent (d4cc60a)