fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1.8.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/modelcontextprotocol/go-sdk	v1.7.0 → v1.8.0

---

Release Notes

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

v1.8.0

Compare Source

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

• internal/json: json nesting depth check by @​yarolegovich (#​1200)
• mcp: add an sse event size cap by @​yarolegovich (#​1205)
• mcp: add a max request body size of the old transport by @​yarolegovich (#​1224)
• oauthex: bound dcr read to 1mb by @​yarolegovich (#​1206)
• oauthex: oauth discovery checks by @​yarolegovich (#​1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction.
Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

• mcp: allow restricting the protocol versions a server supports by @​guglielmo-san (#​1199)
• mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @​guglielmo-san (#​1143)
• mcp: limit SSE discover supportedVersions to SSE-defined revisions by @​arimu1 (#​1121)
• mcp: prefer the negotiated protocol version over the request context by @​gwyszynski-sa (#​1163)
• mcp: export ClientSessionOptions.ProtocolVersion by @​arimu1 (#​1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

• mcp: allow per request Cacheable customization by @​guglielmo-san (#​1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

• plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #​1143.
• blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #​1151.

Options below were removed, according to plan:

• seterroroverwrite
• enableoriginverification
• disablecontenttypecheck
• disablelocalhostprotection

Other Changes to the SDK

• mcp: fix ListTools panic and null normalization on malformed tools by @​n0liu (#​1120)
• mcp: avoid panicking when a resource handler returns nil by @​latent-9 (#​1176)
• mcp: prevent MemoryEventStore.After panic on index past the end by @​PratikDhanave (#​1132)
• internal/jsonrpc2: test WireError.Is and fix nil target panic by @​aha-jansen (#​1079)
• jsonrpc2: wrap write error in server-closing error by @​Tethys0 (#​1186)
• internal/jsonrpc2: plumb cancellation cause through request context by @​aha-jansen (#​1103)
• mcp: preserve single-request batch responses by @​wmh123wmh1 (#​1214)
• mcp: don't mutate caller params on multi-round-trip retries by @​yhxlele (#​1145)
• mcp: do not check metatada on notifications by @​guglielmo-san (#​1215)
• fix: only subscribe when server advertises capability by @​yarolegovich (#​1221)
• mcp: tolerate 404 on subscriptions/listen in stateless mode by @​smlx (#​1193)
• mcp: keep request log levels scoped to each request by @​jstar0 (#​1168)
• mcp: add docs for tier 1 assessment by @​guglielmo-san (#​1195)
• docs: make the protocol.md table of contents resolve by @​tonydzi (#​1196)
• docs: fix the streamable client snippet to use (*Client).Connect by @​tonydzi (#​1142)
• docs: quick start go get leaves the module unbuildable by @​tonydzi (#​1148)
• docs: fix four dead links to the Multi Round-Trip Requests section by @​tonydzi (#​1159)
• mcp: fix typo in protocol version comment by @​latent-9 (#​1156)
• mcp: fix ListChanged doc comments on server capabilities by @​qhzhu (#​1219)
• mcp: add ServerSession.NotifyElicitationComplete by @​guglielmo-san (#​1194)
• mcp: update conformance tests by @​guglielmo-san (#​1231)
• Disable scheduled nightly runs on forks by @​IAmSurajBobade (#​1083)
• auth: add ScopeFilter hook to AuthorizationCodeHandlerConfig by @​toabctl (#​1044)
• auth: validate unadvertised RFC 9207 iss instead of rejecting it by @​asjdf (#​1187)
• mcp: prevent leaks of ServerSession on StatefulServer by @​guglielmo-san (#​1137)
• mcp: avoid Client.Connect leaks by @​guglielmo-san (#​1158)
• mcp: resolve deadlock on serverSession.Close() with subscriptionsListen call by @​guglielmo-san (#​1166)
• mcp: prune completed listen request IDs from the session by @​latent-9 (#​1190)
• mcp: bound streamable Close DELETE so a silent peer cannot hang teardown by @​LPX-E5BD8 (#​1184)
• mcp: allow asynchronous cancel notification by @​guglielmo-san (#​1151)
• mcp: fix error propagation to prevent session closing by @​guglielmo-san (#​1118)
• refactor: remove legacy MCPGODEBUG compatibility for new protocol release by @​guglielmo-san
• build(deps): bump the codeql-action group with 3 updates by @​dependabot (#​1122)
• build(deps): bump the codeql-action group with 3 updates by @​dependabot (#​1216)
• build(deps): bump actions/setup-node from 6.0.0 to 7.0.0 by @​dependabot (#​1123)
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @​dependabot (#​1124)
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot (#​1125)
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot (#​1126)
• build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 by @​dependabot (#​1218)
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot (#​1217)

New Contributors

• @​n0liu made their first contribution in #​1120
• @​arimu1 made their first contribution in #​1127
• @​tonydzi made their first contribution in #​1142
• @​latent-9 made their first contribution in #​1156
• @​jstar0 made their first contribution in #​1168
• @​gwyszynski-sa made their first contribution in #​1163
• @​aha-jansen made their first contribution in #​1103
• @​PratikDhanave made their first contribution in #​1132
• @​LPX-E5BD8 made their first contribution in #​1184
• @​asjdf made their first contribution in #​1187
• @​Tethys0 made their first contribution in #​1186
• @​wmh123wmh1 made their first contribution in #​1214
• @​yhxlele made their first contribution in #​1145
• @​qhzhu made their first contribution in #​1219

Full Changelog: modelcontextprotocol/go-sdk@v1.7.0...v1.8.0-pre.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ChrisJBurns]

@copilot can you investigate the failing tests

[Copilot]

@copilot can you investigate the failing tests

The failure is isolated to TestClient_IntegrationSSE (cmd/yardstick-client/main_test.go:230): it expects protocol 2026-07-28, but the mock SSE server negotiates 2025-11-25. The mock is created with default server options, so this test’s assumption that it negotiates the Modern protocol is incorrect. Lint and both security scans passed; the test job stopped at this unit-test failure, so integration tests were skipped. The dependency bump itself builds; the immediate fix is to correct the SSE mock/test setup or its expected protocol version.

[ChrisJBurns]

@copilot Please fix

[Copilot]

@copilot Please fix

Fixed the SSE test to assert the legacy protocol version the mock actually negotiates and updated its comment. Focused and full Go unit tests pass. Commit: b7cdcb0.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.