Skip to content

build(deps): bump mcp/sdk from 0.7.1 to 0.8.1 - #4632

Merged
thorsten merged 1 commit into
mainfrom
dependabot/composer/mcp/sdk-0.8.1
Sep 12, 2026
Merged

build(deps): bump mcp/sdk from 0.7.1 to 0.8.1#4632
thorsten merged 1 commit into
mainfrom
dependabot/composer/mcp/sdk-0.8.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps mcp/sdk from 0.7.1 to 0.8.1.

Release notes

Sourced from mcp/sdk's releases.

v0.8.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/php-sdk@v0.8.0...v0.8.1

v0.8.0

2026-07-28 Support incl. Stateless HTTP Transport

With v0.8.0 we are shipping support for the 2026-07-28 Model Context Protocol specification, which includes a major rework on HTTP transport going stateless, while keeping older versions of the specifications alive and mostly compatible in userland code. Find a detailed CHANGELOG in the repository, and per PR below.

What's Changed

... (truncated)

Changelog

Sourced from mcp/sdk's changelog.

Changelog

All notable changes to mcp/sdk will be documented in this file.

0.9.0

  • [BC Break] Remove the providerClass argument of #[CompletionProvider]. Use provider:, which takes the same class-string and is now the first positional argument.
  • Add HttpTransport::getSessionId() to read the server-minted Mcp-Session-Id: a request-scoped caller can persist it and pass it back through the constructor's $headers on a later transport. Always null on 2026-07-28, which removed protocol-level sessions.

0.8.0

  • Support for MCP spec version 2026-07-28 incl. stateless HTTP transport
    • Negotiate the protocol revision during initialize: the server counter-offers a revision it supports and the client fails the handshake instead of continuing on an unagreed one. Adds Client::getProtocolVersion().
    • Serve both protocol eras from one endpoint: StreamableHttpTransport classifies each request (InboundClassifier) and routes it to the matching dispatcher, so one URL answers modern and handshake-era clients alike. Builder::withoutModernEra() opts out, Builder::setModernVersions() narrows the modern leg.
    • Speak the lifecycle from the client: Client opens with server/discover, stamps _meta with version, capabilities and client info, and sends the Mcp-Method/Mcp-Name/Mcp-Param-* headers (via Client\Stateless\ToolCatalog). Schema\Wire\McpHeader holds the shared header names.
    • Add multi round-trip requests (SEP-2322): a handler returning InputRequiredResult yields resultType: "input_required" with an opaque, signed requestState (RequestStateCodec, key via Builder::setRequestState()); the client retries with inputResponses, read through RequestContext::getInputContext() and its typed elicitResult()/samplingResult()/rootsResult(). On the client, InputRequestResolver answers such results automatically from the host's elicitation, sampling and roots handlers.
    • Serve ClientGateway::elicit()/elicitUrl() on every revision: where the client cannot be asked mid-request, Server\Stateless\ElicitationReplay turns the ask into input_required and resumes once re-sent — the handler is entered once per ask. InputRequiredShim does the reverse for handshake-era clients. sample()/listRoots() raise a LogicException on 2026-07-28, which removed them.
    • Run stateless handlers in a fiber so $gateway->progress()/log() stream over SSE when the handler emits something and the client accepts text/event-stream; honour io.modelcontextprotocol/logLevel (SEP-2575). Adds LoggingLevel::severity()/isAtLeast().
    • Deliver notifications on subscriptions/listen (SEP-2575) via NotificationBusInterface — InMemoryNotificationBus for persistent runtimes, Psr16NotificationBus for PHP-FPM — set with Builder::setNotificationBus(); Builder::setSubscriptionLifetime() replaces the hard-coded 30s ceiling.
    • Validate the standard request headers (SEP-2243) with StandardHeaderValidator (Builder::setHeaderValidator()), answering -32020 when they contradict the body.
    • Add Wire\CachePolicy (Builder::setCachePolicy()) for SEP-2549 caching hints; defaults to ttlMs: 0, cacheScope: private. A ReadResourceResult may override with its own values.
    • Carry W3C trace context (SEP-414): traceparent/tracestate/baggage from _meta are exposed via RequestContext::getTraceContext() and echoed onto the request's notifications.
    • Close the schema gaps for 2025-06-18/2025-11-25 and add the 2026-07-28 surface (SEP-2106): url-mode elicitation (ClientGateway::elicitUrl()/supportsElicitationUrl()), Implementation::title, and outputSchema/structuredContent accepting any JSON value.
    • Deprecate Roots, Sampling and Logging (SEP-2577, earliest removal 2027-07-28); they keep working but trigger a deprecation notice.
    • [BC Break] Answer a not-found subject with -32602 instead of -32002 (SEP-2164): resources/read picks the code by revision (-32602 from 2026-07-28 on), prompts/get, completion/complete and tools/call switch on every revision. Adds ProtocolVersion::usesInvalidParamsForResourceNotFound().
    • [BC Break] A list-shaped tool result is only sent as structuredContent on 2026-07-28+; older revisions keep the JSON-encoded value in content.
  • [BC Break] Add the extensions framework (SEP-2133) MCP Apps sits on: ExtensionInterface::getId() returns an ExtensionIdentifier value object, and the interface gains getMessages()/getRequestHandlers() (extend AbstractExtension to skip both). MessageFactory::make() takes an $additional message list; RequestHandlerInterface's result template is covariant. ServerExtensionInterface is replaced by the side-agnostic Schema\Extension\ExtensionInterface.
  • Add client-side extension negotiation: ClientGateway::supportsExtension(), Client\Builder::enableExtension(), ClientCapabilities::withExtensions().
  • Add sampling-with-tools: sampling requests can carry tools and tool-choice preferences, messages support tool-use/tool-result blocks, and clients advertise sampling.context/sampling.tools (ClientGateway::supportsSamplingTools()/supportsSamplingContext()). Requests violating the tool-flow rules are rejected with a JSON-RPC error.
  • [BC Break] SamplingMessage::$content and CreateSamplingMessageResult::$content may be a list of content blocks — use getContentBlocks(). CreateSamplingMessageResult rejects roles other than assistant and empty content.
  • Add client-side Roots support (RootsCallbackInterface, Client::sendRootsListChanged()) and server-side ClientGateway::listRoots()/supportsRoots()/supportsSampling().
  • Add Schema\Content\ResourceLink to reference a resource by URI in tool results and prompt messages.
  • [BC Break] Schema\JsonRpc\Error accepts null as $id; an unreadable id now omits the member instead of sending "id": "". MessageFactory decodes a missing or null id as an id-less error.
  • Preserve the request id on an invalid-but-parseable message (-32600) via InvalidInputMessageException::getRequestId().
  • [BC Break] Drop the SDK-only name pattern on ResourceDefinition/ResourceTemplate $name; the spec allows any string.
  • Log expected tool failures (ToolCallException) at debug level instead of error.
  • Add annotations to ImageContent.
  • Fix empty tool/resource schemas serializing as [] instead of {}.
  • Fix PromptResultFormatter dropping annotations, _meta and mimeType for plain-array content.

0.7.0

  • Add client-side elicitation support: ElicitationCallbackInterface, ElicitationRequestHandler, and ElicitationException let clients respond to server elicitation requests.
  • Defer element loading to the first registry read: loaders now run at request time (first has*/get* call) instead of eagerly at Builder::build(), fixing empty registries under persistent runtimes (e.g. FrankenPHP worker mode) where a loader's data source is not ready at build time. Adds Builder::setLazyLoading() (default on), a public Registry::load(), and an optional LoaderInterface constructor argument on Registry.
  • [BC Break] Element loading is lazy by default: loader failures now surface on the first request rather than at Builder::build(), and initialize advertises capabilities from the configured sources rather than the loaded registry. Call Builder::setLazyLoading(false) to restore eager build-time loading.
  • Allow [$instance, 'methodName'] as an element handler in Builder::addTool(), addResource(), addResourceTemplate(), and addPrompt(). Unblocks handlers with constructor dependencies that the container-less new $className() fallback cannot build.
  • Always emit an items schema for array tool parameters: untyped arrays get items: {} and nullable typed arrays (e.g. string[]|null) keep their element type. Fixes strict clients rejecting tools with "array type must have items" (#151).

... (truncated)

Commits
  • c5dbfb6 [Server][Capability] Do not announce an externally loaded registry as changed...
  • 46628fb [Capability] Cast variadic tool parameters element-by-element (#465)
  • e473c3c chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#483)
  • e173367 [Server] Keep injectable parameters out of the published inputSchema (#482)
  • ff0b5fa [Capability] Extract shared element name/description resolution (#481)
  • 312c621 [Capability] Suppress list-changed events during the initial registry load (#...
  • c36e805 [Server] Restrict FileSessionStore::gc() to owned session files (#479)
  • d59950f [Server][Client] Bridge W3C trace context between HTTP headers and _meta (SEP...
  • 1e9520e [Docs] Deprecation policy, SDK tier target, and CONTRIBUTING.md (#472)
  • d09fe30 [Server] Make resource subscribe/unsubscribe errors protocol-version-aware (S...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file PHP Pull requests that update Php code labels Sep 11, 2026
@coderabbitai

coderabbitai Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 64cb286d-6c86-4739-b155-2783732dce6f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot
dependabot Bot force-pushed the dependabot/composer/mcp/sdk-0.8.1 branch 2 times, most recently from 5ee9ed9 to 6733c32 Compare September 11, 2026 07:04
@dependabot
build(deps): bump mcp/sdk from 0.7.1 to 0.8.1
ffc4952 
Bumps [mcp/sdk](https://github.com/modelcontextprotocol/php-sdk) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/modelcontextprotocol/php-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/php-sdk/blob/main/CHANGELOG.md)
- [Commits](modelcontextprotocol/php-sdk@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: mcp/sdk
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/composer/mcp/sdk-0.8.1 branch from 6733c32 to ffc4952 Compare September 11, 2026 07:25
@thorsten
thorsten merged commit 9a41eae into main Sep 12, 2026
17 checks passed
@thorsten
thorsten deleted the dependabot/composer/mcp/sdk-0.8.1 branch September 12, 2026 10:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file PHP Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thorsten