chore(deps): bump the all group with 9 updates

[dependabot]

Bumps the all group with 9 updates:

Package	From	To
github.com/modelcontextprotocol/go-sdk	1.7.0	1.8.0
github.com/sourcegraph/jsonrpc2	0.2.2	0.2.3
golang.org/x/image	0.45.0	0.46.0
golang.org/x/net	0.58.0	0.59.0
golang.org/x/oauth2	0.36.0	0.37.0
golang.org/x/sync	0.22.0	0.23.0
golang.org/x/sys	0.47.0	0.48.0
golang.org/x/text	0.41.0	0.42.0
mvdan.cc/sh/v3	3.14.1-0.20260903180852-b94799068be2	3.14.1

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

• internal/json: json nesting depth check by @​yarolegovich (#1200)
• mcp: add an sse event size cap by @​yarolegovich (#1205)
• mcp: add a max request body size of the old transport by @​yarolegovich (#1224)
• oauthex: bound dcr read to 1mb by @​yarolegovich (#1206)
• oauthex: oauth discovery checks by @​yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

• mcp: allow restricting the protocol versions a server supports by @​guglielmo-san (#1199)
• mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @​guglielmo-san (#1143)
• mcp: limit SSE discover supportedVersions to SSE-defined revisions by @​arimu1 (#1121)
• mcp: prefer the negotiated protocol version over the request context by @​gwyszynski-sa (#1163)
• mcp: export ClientSessionOptions.ProtocolVersion by @​arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

• mcp: allow per request Cacheable customization by @​guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

• plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
• blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

• seterroroverwrite
• enableoriginverification
• disablecontenttypecheck

... (truncated)

Commits

• 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
• 830f0b7 mcp: update conformance tests (#1231)
• 12cbafe oauthex: oauth discovery checks (#1220)
• 3632967 mcp: add an sse event size cap (#1205)
• 0d3036f mcp: allow per request Cacheable customization (#1203)
• cb0de64 mcp: add a max request body size of the old transport (#1224)
• 2fdabde mcp: do not check metatada on notifications (#1215)
• 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
• a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
• 8227246 fix: only subscribe when server advertises capability (#1221)
• Additional commits viewable in compare view

Updates github.com/sourcegraph/jsonrpc2 from 0.2.2 to 0.2.3

Release notes

Sourced from github.com/sourcegraph/jsonrpc2's releases.

v0.2.3

What's Changed

• docs: clarify reply and handler ordering by @​keegancsmith in sourcegraph/jsonrpc2#105
• fix/conn: prevent panic when closing during response processing by @​keegancsmith in sourcegraph/jsonrpc2#104

Full Changelog: sourcegraph/jsonrpc2@v0.2.2...v0.2.3

Commits

• f50bb34 Bump github.com/gorilla/websocket from 1.4.1 to 1.5.3 (#102)
• ae9a040 fix/conn: prevent close-response race panic (#104)
• bf8fe04 docs/conn: clarify ordering guarantees for bidirectional calls (#105)
• fb2b860 Bump actions/setup-go from 6 to 7 in the github-actions group (#101)
• bacb7f3 Merge pull request #100 from sourcegraph/k/remove-broken-scip-upload
• f0eebfe chore/ci: stop requiring unauthenticated SCIP uploads
• See full diff in compare view

Updates golang.org/x/image from 0.45.0 to 0.46.0

Commits

• b06f1de go.mod: update golang.org/x dependencies
• 09b0b4f all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/net from 0.58.0 to 0.59.0

Commits

• 540d04c go.mod: update golang.org/x dependencies
• 20eef7f quic: clear fast-path receive buffer on stream reset
• c23af1b internal/http3: fix compilation error due to missed symbol name update
• eda109f internal/http3: send appropriate error codes in STOP_SENDING frames
• 12e0501 internal/http3: server header size limits
• d89285e quic: add Stream.StopSending, and rework stream/application errors
• d34deae quic: ensure Endpoint.Close waits for connection loops to exit
• 55577aa http2: use IDNA Lookup profile, not raw Punycode translation
• b22627e internal/http3: handle a nil TLSConfig in newQUICConfig
• 6e98b0d internal/http3: report endpoint creation errors from initEndpoint
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits

• c624b89 google: change the snake case endpoint to kebab-case
• 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/sync from 0.22.0 to 0.23.0

Commits

• f75267d semaphore: panic on negative capacity
• 3ffd83c all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits

• 613e257 cpu: add riscv64 hwprobe drift test
• 6f7b10f unix: add MLOCK_ONFAULT constant
• 663e7c8 cpu: add basic support for GOARCH=sparc64
• de5f12f cpu: add ppc64le POWER10 detection
• 80e8acf unix: run go fix
• 1e3c182 unix: add IPMI interface
• d429e20 unix: stop generating sparc termbits from the generic header
• bd3bddf unix: add missing HWTSTAMP_* constants
• e812f53 windows: add SO_SNDTIMEO constant for socket options
• f6989c5 unix: align Ifreq so its union accessors cannot fault
• Additional commits viewable in compare view

Updates golang.org/x/text from 0.41.0 to 0.42.0

Commits

• fafe4a0 go.mod: update golang.org/x dependencies
• f53c316 unicode/norm: don't truncate runes in the recomposition map key
• 37867f6 unicode/norm: let any starter block composition in compose
• 0dd525f unicode/norm: compose non-Hangul runes after a Hangul syllable
• bac26e5 unicode/norm: avoid improper ErrShortDst return in Form.transform
• 4f55186 unicode/norm: simplify short source detection in Form.transform
• a1b6c10 unicode/norm: prevent decomposeSegment from moving backwards
• cd1cbc9 unicode/bidi: panic rather than log.Panicf
• a459614 internal/export/idna: fix conformance with optional validation disabled
• be70a61 internal/export/idna: drop trie field from Profiles
• Additional commits viewable in compare view

Updates mvdan.cc/sh/v3 from 3.14.1-0.20260903180852-b94799068be2 to 3.14.1

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.14.1

• syntax
  • Fix the indentation of heredocs nested inside command substitutions - #1403
  • Keep literal tabs in <<- heredoc bodies rather than replacing them with spaces
  • Don't indent heredocs without dashes nested in <<- ones, whose output no longer parsed
  • Zsh: don't drop the prefix in short forms like $#"$foo" and $+"$foo" - #1405
• interp
  • Fix the build on 32-bit FreeBSD and NetBSD
• expand
  • Don't let escaped characters such as \* act as glob metacharacters
• pattern
  • Treat unclosed extended operator groups like @(a as literals, avoiding a panic

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.27.1 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.14.1] - 2026-09-06

• syntax
  • Fix the indentation of heredocs nested inside command substitutions - #1403
  • Keep literal tabs in <<- heredoc bodies rather than replacing them with spaces
  • Don't indent heredocs without dashes nested in <<- ones, whose output no longer parsed
  • Zsh: don't drop the prefix in short forms like $#"$foo" and $+"$foo" - #1405
• interp
  • Fix the build on 32-bit FreeBSD and NetBSD
• expand
  • Don't let escaped characters such as \* act as glob metacharacters
• pattern
  • Treat unclosed extended operator groups like @(a as literals, avoiding a panic

[3.14.0] - 2026-08-28

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373
  • Run files as shell scripts when exec fails with ENOEXEC - #1065
  • Support empty here-documents, and don't expand quoted ones - #1390

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: area: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.