chore(deps): bump mcp from 0.23.0 to 0.25.0

[dependabot]

Bumps mcp from 0.23.0 to 0.25.0.

Release notes

Sourced from mcp's releases.

v0.25.0

Added

• Support SEP-990 Cross-App Access via ID-JAG and the jwt-bearer grant (#454)
• Support client-side sampling via MCP::Client#on_sampling (#458)

Fixed

• Reject notifications carrying an unknown or expired session (#455)
• Handle an initialize request sent without an ID (#456)
• Bound client-side message buffering in the HTTP transport (#459)
• Lowercase response header names in StreamableHTTPTransport (#460)

v0.24.0

Added

• Support SSE reconnection per SEP-1699 in the HTTP client transport (#426)
• Validate the RFC 9207 iss authorization response parameter per SEP-2468 (#431)
• Support private_key_jwt client authentication for the client_credentials grant (#432)
• Recognize multi round-trip input_required results per SEP-2322 (#433)
• Add opt-in ttlMs / cacheScope cache hints to List and Read results per SEP-2549 (#436)
• Add server/discover and stateless lifecycle error codes per SEP-2575 (#438)
• Associate server-to-client requests with the originating client request per SEP-2260 (#440)
• Add server-side MCP Apps helpers per SEP-1865 (#441)
• Support client-side elicitation with SEP-1034 schema defaults (#443)
• Support class-based Resource and ResourceTemplate definitions (#447)

Changed

• Bind stored client credentials to the authorization server issuer per SEP-2352 (#439)

Fixed

• Handle non-object JSON-RPC messages without raising (#448)
• Perform SSE stream writes outside the session mutex (#449)
• Validate required params for initialize and resources/subscribe (#451)

Changelog

Sourced from mcp's changelog.

[0.25.0] - 2026-07-18

Added

• Support SEP-990 Cross-App Access via ID-JAG and the jwt-bearer grant (#454)
• Support client-side sampling via MCP::Client#on_sampling (#458)

Fixed

• Reject notifications carrying an unknown or expired session (#455)
• Handle an initialize request sent without an ID (#456)
• Bound client-side message buffering in the HTTP transport (#459)
• Lowercase response header names in StreamableHTTPTransport (#460)

[0.24.0] - 2026-07-12

Added

• Support SSE reconnection per SEP-1699 in the HTTP client transport (#426)
• Validate the RFC 9207 iss authorization response parameter per SEP-2468 (#431)
• Support private_key_jwt client authentication for the client_credentials grant (#432)
• Recognize multi round-trip input_required results per SEP-2322 (#433)
• Add opt-in ttlMs / cacheScope cache hints to List and Read results per SEP-2549 (#436)
• Add server/discover and stateless lifecycle error codes per SEP-2575 (#438)
• Associate server-to-client requests with the originating client request per SEP-2260 (#440)
• Add server-side MCP Apps helpers per SEP-1865 (#441)
• Support client-side elicitation with SEP-1034 schema defaults (#443)
• Support class-based Resource and ResourceTemplate definitions (#447)

Changed

• Bind stored client credentials to the authorization server issuer per SEP-2352 (#439)

Fixed

• Handle non-object JSON-RPC messages without raising (#448)
• Perform SSE stream writes outside the session mutex (#449)
• Validate required params for initialize and resources/subscribe (#451)

Commits

• f9fd78e Merge pull request #462 from koic/release_0_25_0
• df578d7 Release 0.25.0
• 0b51173 Merge pull request #460 from koic/lowercase_response_header_names
• b1b50da Merge pull request #461 from koic/avoid_cancelling_conformance_runs_on_main
• c78d4a2 Avoid cancelling in-progress conformance runs on main
• 991926a Lowercase response header names in StreamableHTTPTransport
• cc219a2 Merge pull request #458 from koic/feature_sampling_client
• 7ebaf98 Merge pull request #459 from koic/bound_client_sse_event_buffering
• 5533a6d Merge pull request #454 from koic/cross_app_access
• ced5cd1 Bound client-side message buffering in the HTTP transport
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #27.