Merge upstream main and retain idle GET regression

Author: karthiksenv

.github/dependabot.yml

@@ -1,28 +1,92 @@
 version: 2
 updates:
-    - package-ecosystem: 'github-actions'
-      directory: '/'
-      schedule:
-          interval: monthly
-      labels:
-        - 'github_actions'
-        - 'waiting for triage'
-    - package-ecosystem: 'maven'
-      directory: '/'
-      schedule:
-          interval: monthly
-      open-pull-requests-limit: 10
-      labels:
-        - 'dependencies'
-        - 'waiting for triage'
-      ignore:
-          # Freeze production dependencies of mcp-core
-          - dependency-name: 'org.slf4j:slf4j-api'
-          - dependency-name: 'com.fasterxml.jackson.core:jackson-annotations'
-          - dependency-name: 'tools.jackson.core:jackson-databind'
-          - dependency-name: 'io.projectreactor:reactor-bom'
-          - dependency-name: 'io.projectreactor:reactor-core'
-          - dependency-name: 'jakarta.servlet:jakarta.servlet-api'
-          # mcp-json-jackson2 and mcp-json-jackson3 dependencies
-          - dependency-name: 'com.fasterxml.jackson.core:jackson-databind'
-          - dependency-name: 'com.networknt:json-schema-validator'
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: weekly
+    labels:
+      - 'github_actions'
+      - 'waiting for triage'
+  # Active development line: all updates, except minor and major updates of production dependencies
+  - package-ecosystem: 'maven'
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 15
+    labels:
+      - 'dependencies'
+      - 'waiting for triage'
+    ignore:
+      # mcp-core production dependencies
+      - dependency-name: 'org.slf4j:slf4j-api'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      - dependency-name: 'com.fasterxml.jackson.core:jackson-annotations'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      - dependency-name: 'io.projectreactor:reactor-bom'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      - dependency-name: 'io.projectreactor:reactor-core'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      - dependency-name: 'jakarta.servlet:jakarta.servlet-api'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      # mcp-json-jackson2 and mcp-json-jackson3 production dependencies
+      - dependency-name: 'com.fasterxml.jackson.core:jackson-databind'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      - dependency-name: 'tools.jackson.core:jackson-databind'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      - dependency-name: 'com.networknt:json-schema-validator'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+      # mcp-test compile dependencies, which end up on consumers' test classpath
+      - dependency-name: 'org.assertj:assertj-core'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'org.junit.jupiter:*'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'org.mockito:mockito-core'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'org.testcontainers:*'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'org.awaitility:awaitility'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'ch.qos.logback:logback-classic'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'net.javacrumbs.json-unit:json-unit-assertj'
+        update-types: ['version-update:semver-major']
+  # Maintenance lines: patch updates only
+  - package-ecosystem: 'maven'
+    directory: '/'
+    target-branch: '2.1.x'
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 10
+    labels:
+      - 'dependencies'
+      - 'maintenance'
+      - 'waiting for triage'
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+  - package-ecosystem: 'maven'
+    directory: '/'
+    target-branch: '1.1.x'
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 10
+    labels:
+      - 'dependencies'
+      - 'maintenance'
+      - 'waiting for triage'
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']
+  - package-ecosystem: 'maven'
+    directory: '/'
+    target-branch: '0.18.x'
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 10
+    labels:
+      - 'dependencies'
+      - 'maintenance'
+      - 'waiting for triage'
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major', 'version-update:semver-minor']

.github/workflows/ci.yml

@@ -4,37 +4,40 @@ on:
   pull_request: {}
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and Test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Build
-        run: mvn verify
+        run: ./mvnw verify
 
   jackson2-tests:
     name: Jackson 2 Integration Tests
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Jackson 2 Integration Tests
-        run: mvn -pl mcp-test -am -Pjackson2 test
+        run: ./mvnw -pl mcp-test -am -Pjackson2 test

.github/workflows/conformance.yml

@@ -6,10 +6,48 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+env:
+  CONFORMANCE: '@modelcontextprotocol/conformance@0.2.0-alpha.12'
+
 jobs:
   server:
     name: Server Conformance
     runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v6
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: 'maven'
+
+      - name: Build and start server
+        run: |
+          ./mvnw clean install -DskipTests
+          ./mvnw exec:java -pl conformance-tests/server-servlet -Dexec.mainClass="io.modelcontextprotocol.conformance.server.ConformanceServlet" &
+          timeout 30 bash -c 'until curl -s http://localhost:8080/mcp > /dev/null 2>&1; do sleep 0.5; done'
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Run conformance tests
+        run: |
+          npx --yes "$CONFORMANCE" server \
+            --url http://localhost:8080/mcp \
+            --suite active \
+            --spec-version 2025-11-25 \
+            --expected-failures ./conformance-tests/conformance-baseline.yml
+
+  modern-server:
+    name: Modern Server Conformance (2026-07-28)
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -23,16 +61,19 @@ jobs:
       - name: Build and start server
         run: |
           mvn clean install -DskipTests
-          mvn exec:java -pl conformance-tests/server-servlet -Dexec.mainClass="io.modelcontextprotocol.conformance.server.ConformanceServlet" &
-          timeout 30 bash -c 'until curl -s http://localhost:8080/mcp > /dev/null 2>&1; do sleep 0.5; done'
+          mvn exec:java -pl conformance-tests/server-servlet-modern &
+          timeout 30 bash -c 'until curl -s http://localhost:8081/mcp > /dev/null 2>&1; do sleep 0.5; done'
 
-      - name: Run conformance tests
-        uses: modelcontextprotocol/conformance@v0.1.16
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
-          mode: server
-          url: http://localhost:8080/mcp
-          suite: active
-          expected-failures: ./conformance-tests/conformance-baseline.yml
+          node-version: '22'
+
+      - name: Run conformance tests
+        run: |
+          npx --yes "$CONFORMANCE" server \
+            --url http://localhost:8081/mcp \
+            --requirements 2026-07-28
 
   client:
     name: Client Conformance
@@ -41,25 +82,30 @@ jobs:
       matrix:
         scenario: [initialize, tools_call, elicitation-sep1034-client-defaults, sse-retry]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Build client
-        run: mvn clean install -DskipTests
+        run: ./mvnw clean install -DskipTests
 
-      - name: Run conformance test
-        uses: modelcontextprotocol/conformance@v0.1.16
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
-          mode: client
-          command: 'java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-*-SNAPSHOT.jar'
-          scenario: ${{ matrix.scenario }}
-          expected-failures: ./conformance-tests/conformance-baseline.yml
+          node-version: '22'
+
+      - name: Run conformance test
+        run: |
+          npx --yes "$CONFORMANCE" client \
+            --command 'java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-*-SNAPSHOT.jar' \
+            --scenario ${{ matrix.scenario }} \
+            --spec-version 2025-11-25 \
+            --expected-failures ./conformance-tests/conformance-baseline.yml
 
   auth:
     name: Auth Conformance
@@ -82,17 +128,17 @@ jobs:
         - auth/token-endpoint-auth-none
         - auth/pre-registration
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Build client
-        run: mvn clean install -DskipTests
+        run: ./mvnw clean install -DskipTests
 
       - name: Run conformance test
         uses: modelcontextprotocol/conformance@v0.1.16

.github/workflows/docs.yml

@@ -19,11 +19,11 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: 3.x
 
@@ -37,7 +37,7 @@ jobs:
       - name: Deploy docs (push to main)
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: |
-          PROJECT_VERSION=$(mvn help:evaluate -Dexpression=project.version --quiet -DforceStdout)
+          PROJECT_VERSION=$(./mvnw help:evaluate -Dexpression=project.version --quiet -DforceStdout)
           if [[ "${PROJECT_VERSION}" == *-SNAPSHOT ]]; then
             ALIAS="latest-snapshot"
           else

.github/workflows/maven-central-release.yml

@@ -3,14 +3,17 @@ name: Release to Maven Central
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
@@ -22,19 +25,21 @@ jobs:
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
       # Deploy runs the integration tests, but only with Jackson 3
       # We run Jackson 2 IT manually
       - name: Jackson 2 Integration Tests
-        run: mvn -pl mcp-test -am -Pjackson2 test
+        run: ./mvnw -pl mcp-test -am -Pjackson2 test
 
       # Deploy runs all previous maven goals, including test and verify
+      # Use the wrapper (Maven 3.9.x): with Maven 3.10, central-publishing 0.7.0 leaves
+      # maven-metadata-local.xml files in the bundle, and Central rejects it.
       - name: Publish to Maven Central
         run: |
-          mvn --batch-mode \
+          ./mvnw --batch-mode \
             -Prelease \
             -Pjavadoc \
             clean deploy