Upgrade go-sdk to v1.7.0 - #2968
Conversation
Move from the v1.7.0-pre.3 pre-release to the final v1.7.0 release, which consolidates the pre-releases with no further changes. Regenerate the third-party license files to reflect the new version tag. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 95b8432c-f280-472e-a242-d3ca6dc31f19
The server exposes a static set of tools, prompts, and resources and never mutates them at runtime, so it never emits list_changed notifications. When capabilities are left unset, the go-sdk infers listChanged:true from the presence of items and advertises tools/prompts/resources list-change support we don't actually provide - and the 2026-07-28 spec (subscriptions/listen) tightens expectations around this. Declare empty tools/prompts/resources capabilities in NewMCPServer so both the stdio and remote servers advertise honestly. The remote HTTP handler already set these explicitly; that duplication is now removed in favour of the shared default, leaving only the remote-specific schema cache. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 95b8432c-f280-472e-a242-d3ca6dc31f19
There was a problem hiding this comment.
Pull request overview
Upgrades the MCP Go SDK and centralizes capability declarations.
Changes:
- Upgrades go-sdk to v1.7.0.
- Disables unsupported list-change and deprecated logging capabilities.
- Regenerates platform license manifests.
Show a summary per file
| File | Description |
|---|---|
go.mod |
Updates SDK version. |
go.sum |
Updates dependency checksums. |
pkg/github/server.go |
Defines shared server capabilities. |
pkg/http/handler.go |
Removes redundant HTTP capability setup. |
third-party-licenses.darwin.md |
Updates Darwin license links. |
third-party-licenses.linux.md |
Updates Linux license links. |
third-party-licenses.windows.md |
Updates Windows license links. |
Review details
- Files reviewed: 6/7 changed files
- Comments generated: 2
- Review effort level: Medium
| github.com/lithammer/fuzzysearch v1.1.8 | ||
| github.com/microcosm-cc/bluemonday v1.0.27 | ||
| github.com/modelcontextprotocol/go-sdk v1.7.0-pre.3 | ||
| github.com/modelcontextprotocol/go-sdk v1.7.0 |
There was a problem hiding this comment.
Good catch — you're right, v1.7.0 is not identical to pre.3. There are 4 intervening commits (827f90b..bc72835):
- 问我 #1107 derive
Mcp-Protocol-Versionheader from the outgoing message (streamable HTTP client) - How to use "AssignCodingAgent" prompt (GitHub MCP Server) in another MCP client? #1106 avoid double-copy of payload in
writeEvent(SSE perf) - build(deps): bump github.com/mark3labs/mcp-go from 0.36.0 to 0.40.0 #1115 fix potential nil-pointer dereference on message send (streamable client robustness)
- Add tools for Projects V2 #1114 conformance fixtures update (test infra only)
I've assessed them: all are transport-layer bug fixes / a micro-optimization, none breaking, and none require changes on our side (they only touch the streamable HTTP client and SSE writing). Updated the PR description to list them and drop the "tag-only release" framing.
| Capabilities: &mcp.ServerCapabilities{ | ||
| Tools: &mcp.ToolCapabilities{}, | ||
| Prompts: &mcp.PromptCapabilities{}, | ||
| Resources: &mcp.ResourceCapabilities{}, | ||
| }, |
There was a problem hiding this comment.
Done — added TestNewMCPServer_AdvertisedCapabilities in pkg/github/server_test.go (commit 1709a5d). It connects an in-memory client and asserts the advertised capabilities: tools/prompts/resources present with listChanged == false, resources.subscribe == false, completions preserved, and logging absent. It runs two sub-cases sharing the NewMCPServer entry point — the stdio path (full inventory, items present) and the HTTP path (ForMCPRequest(MCPMethodDiscover, ""), no items registered) — so both users are covered. I verified it fails without the capability declaration (tools would advertise listChanged:true on stdio and be absent entirely on the HTTP/discovery path).
Add a regression test locking in the capability contract set by NewMCPServer: tools, prompts, and resources are advertised without list-changed notifications, the deprecated logging capability is not advertised, and the inferred completions capability is preserved. Covers both the stdio path (full inventory, items present) and the HTTP path (inventory emptied for the discovery request), which share the same NewMCPServer entry point. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 95b8432c-f280-472e-a242-d3ca6dc31f19
What
github.com/modelcontextprotocol/go-sdkfromv1.7.0-pre.3→v1.7.0(notes).listChanged(and the deprecatedlogging) capabilities we don't actually support, and adds a regression test for the capability contract.Changes between
v1.7.0-pre.3andv1.7.0The final tag is not identical to
pre.3— there are 4 upstream commits between them (827f90b..bc72835). None are breaking and none require changes on our side; they are transport-layer bug fixes and a micro-optimization:mcp: derive Mcp-Protocol-Version header from the outgoing message— the streamable HTTP client now sources theMcp-Protocol-Versionheader from the request's_meta.protocolVersionfirst (falling back to context, then the initialized result). Client-side header correctness; no server-side impact.mcp: avoid double-copy of payload in writeEvent— SSEwriteEventwrites the payload into a pre-grown buffer instead ofstring(evt.Data). Pure perf micro-optimization.mcp: fix potential nil-pointer dereference on message send— robustness fix in the streamable clientWritepath.chore: update conformance— conformance test fixtures only; not shipped code.Assessment: these only touch the streamable HTTP client and SSE writing; the bug fixes are strictly beneficial and there are no API or behavior changes affecting this server.
go build, the full test suite, and lint all pass onv1.7.0.Capability change (no list-changed advertising)
The go-sdk infers
listChanged: truefortools/prompts/resourceswhenever items are registered. But this server exposes a static set of tools/prompts/resources and never mutates them at runtime, so it never emitslist_changednotifications — we were advertising a capability we don't implement. The2026-07-28spec (unifiedsubscriptions/listen) tightens expectations here.The remote/HTTP handler already set empty capabilities explicitly. This moves that declaration into
NewMCPServerso both the stdio and remote servers advertise honestly, and removes the now-redundant duplication in the handler (leaving only the remote-specific schema cache).Advertised capabilities before → after (stdio):
Note: this also drops the deprecated
loggingcapability from the stdio server, matching what the remote server already advertised and aligning with the new spec's deprecation of logging.TestNewMCPServer_AdvertisedCapabilitieslocks this in for both the stdio path (items present) and the HTTP path (inventory emptied for discovery), assertinglistChanged == false, no logging, and preserved completions. Verified it fails without the fix.Validation
go build ./...script/test(full suite,-race)script/lint— 0 issuesscript/licenses-check— passes for all platformsNo tool schemas changed, so toolsnaps and generated README docs are unaffected.