chore(deps): update dependency @modelcontextprotocol/sdk to v1.24.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.18.0 -> 1.24.3

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.24.3

Compare Source

What's Changed

• chore: fix dev dependency security vulnerabilities by @​felixweinberger in #​1227
• chore(deps): bump express from 5.0.1 to 5.2.1 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​1228
• fix: release HTTP connections after POST responses by @​mattzcarey in #​1214
• fix: skip priming events and closeSSEStream for old protocol versions by @​felixweinberger in #​1233
• chore: bump version for patch release by @​felixweinberger in #​1235

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.2...1.24.3

v1.24.2

Compare Source

What's Changed

• feat: add optional resource annotations by @​vhorvath2010 in #​954
• chore: refresh CLAUDE.md by @​LucaButBoring in #​1217
• refactor: make Server class framework-agnostic by moving express to separate module by @​cytle in #​1223
• chore: bump version to 1.24.2 by @​pcarleton in #​1224

New Contributors

• @​vhorvath2010 made their first contribution in #​954
• @​cytle made their first contribution in #​1223

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.1...1.24.2

v1.24.1

Compare Source

What's Changed

• fix(streamableHttp): fix infinite retries when maxRetries is set to 0 by @​mrorigo in #​1216
• chore: update protocol version to 2025-11-25 by @​dsp-ant in #​1218
• chore: bump version for release by @​felixweinberger in #​1219

New Contributors

• @​mrorigo made their first contribution in #​1216

Full Changelog: modelcontextprotocol/typescript-sdk@1.24.0...1.24.1

v1.24.0

Compare Source

v1.23.1

Compare Source

Fixed:

• Disabled SSE priming events to fix backwards compatibility - 1.23.x clients crash on empty SSE data (JSON.parse(""))

This is a patch for servers still on 1.23.x that were breaking clients not handling the the 1.24.x priming event behavior with empty SSE data fields. See #​1233 for more details.

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.23.1

v1.23.0

Compare Source

What's Changed

• Migrate to vitest from jest by @​mattzcarey in #​1074
• ci: add workflow_dispatch trigger for manual CI runs by @​felixweinberger in #​1114
• Fix: @​types/node incompatibility with vite warnings on npm install by @​KKonstantinov in #​1121
• Fix: clean up accidental spec.types.ts by @​KKonstantinov in #​1122
• fix: Pass RequestInit options to auth requests by @​dsp-ant in #​1066
• SEP-1036: URL Elicitation by @​nbarbettini in #​1105
• add none to test and the router. by @​m-henderson in #​1116
• [auth] Adjust scope management to line up with SEP-835 by @​pcarleton in #​1133
• chore: add .idea/ to .gitignore by @​maxisbey in #​1134
• chore: remove unused @​types/eslint__js dependency by @​mattzcarey in #​1128
• feat: url based client metadata registration (SEP 991) by @​mattzcarey in #​1127
• feat: zod v4 with backwards compatibility for v3.25+ by @​dclark27 in #​1040
• fix: remove pnpm lock and regenerate package-lock by @​mattzcarey in #​1138
• docs: update installation instructions for zod peer dependency by @​mattzcarey in #​1139
• Implement SEP-1577 - Sampling With Tools by @​ochafik in #​1101
• Follow up: unify v3 and v4 zod types via describe matrix and a test helper by @​KKonstantinov in #​1141
• chore: Add deprecated marker to old elicitInput overload by @​nbarbettini in #​1142
• fix: Connect error in URL elicitation example by @​nbarbettini in #​1136
• Support upscoping on insufficient_scope 403 by @​Nayana-Parameswarappa in #​1115
• Support beta releases by publishing with --tag beta by @​felixweinberger in #​1146
• Bump version to 1.23.0-beta.0 by @​felixweinberger in #​1147
• SEP-1613: use.catchall() on inputSchema/outputSchema to support JSON Schema 2020-12 by @​felixweinberger in #​1135
• sampling: validate tools, tool_use, tool_result constraints by @​ochafik in #​1156
• fix: React to upstream RC schema changes for form mode elicitation requests by @​felixweinberger in #​1164
• feat: implement SEP-1699 SSE polling via server-side disconnect by @​felixweinberger in #​1129
• chore: bump package number for release by @​felixweinberger in #​1170

New Contributors

• @​nbarbettini made their first contribution in #​1105
• @​m-henderson made their first contribution in #​1116
• @​maxisbey made their first contribution in #​1134
• @​dclark27 made their first contribution in #​1040
• @​Nayana-Parameswarappa made their first contribution in #​1115

Full Changelog: modelcontextprotocol/typescript-sdk@1.22.0...1.23.0

v1.22.0

Compare Source

What's Changed

• registerTool: accept ZodType for input and output schema by @​ksinder in #​816
• SEP-1319: Decouple Request Payloads, Remove passthrough iteration, Typecheck fixes by @​KKonstantinov in #​1086
• add pkg-pr-new bot by @​pcarleton in #​1088
• Upgrade to Node LTS by @​mattzcarey in #​1072
• change step name by @​pcarleton in #​1089
• SEP-1034: Default values for Elicitation Schemas by @​KKonstantinov in #​1096
• SEP-1330: Compatibility with SEP-1034 by @​KKonstantinov in #​1100
• Implementation of SEP-986: Specify Format for Tool Names by @​kentcdodds in #​900
• [auth] Fix march spec fallback for metadata discovery by @​pcarleton in #​1108
• chore: bump version for release by @​felixweinberger in #​1110

New Contributors

• @​ksinder made their first contribution in #​816

Full Changelog: modelcontextprotocol/typescript-sdk@1.21.1...1.22.0

v1.21.2

Compare Source

What's changed

This is a patch release for a regression highlighted by #​1103

This patch contains only the cherry picked fix in #​1108

Full Changelog: modelcontextprotocol/typescript-sdk@1.21.1...1.21.2

v1.21.1

Compare Source

What's Changed

• Only use path-based discovery URLs from the authorization server to discover metadata by @​roadmapper in #​1070
• Add @​deprecated annotations to legacy APIs by @​domdomegg in #​1018
• fix: Support WWW-Authenticate scope param for SEP-835 by @​chipgpt in #​983
• move CLI script to dedicated scripts directory by @​mattzcarey in #​1073
• Check script which typechecks using Typescripts new Go port by @​mattzcarey in #​1075
• FIX: use a nightly spec.types.ts by @​mattzcarey in #​1087
• chore: bump version for release by @​felixweinberger in #​1085

New Contributors

• @​roadmapper made their first contribution in #​1070

Full Changelog: modelcontextprotocol/typescript-sdk@1.21.0...1.21.1

v1.21.0

Compare Source

What's Changed

• feat: pluggable JSON schema validator providers by @​mattzcarey in #​1012
• Update metadata.ts by @​pcarleton in #​1010
• fix: Prefer the token_endpoint_auth_method response from DCR registration by @​chipgpt in #​1022
• Fix: Non-existent tool, disabled tool and inputSchema validation return MCP protocol level instead of CallToolResult with isError: true by @​KKonstantinov in #​1044
• chore: bump version to 1.21.0 for release by @​felixweinberger in #​1062

New Contributors

• @​chipgpt made their first contribution in #​1022

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.2...1.21.0

v1.20.2

Compare Source

What's Changed

• fix: Zod to JSONSchema pipe strategies by @​pierreliefauche in #​962
• chore: bump version for weekly release by @​felixweinberger in #​1042

New Contributors

• @​pierreliefauche made their first contribution in #​962

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.1...1.20.2

v1.20.1

Compare Source

What's Changed

• fix: Add Accept header to auth metadata request by @​SVLaursen in #​901
• Allow empty string as valid URL in DCR workflow by @​fredericbarthelet in #​987
• docs: fix summary contents at readme by @​starfish719 in #​1025
• chore: bump version to 1.20.1 for release by @​felixweinberger in #​1032

New Contributors

• @​SVLaursen made their first contribution in #​901
• @​starfish719 made their first contribution in #​1025

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.0...1.20.1

v1.20.0

Compare Source

What's Changed

• docs: improve main README with better quick start, include examples of stateless HTTP, explain tools v resources v prompts by @​domdomegg in #​980
• chore: add lint:fix script by @​mattzcarey in #​1013
• Default to S256 code challenge if not specified in authorization server metadata by @​LucaButBoring in #​992

New Contributors 🙏

• @​mattzcarey made their first contribution in #​1013

Full Changelog: modelcontextprotocol/typescript-sdk@1.19.0...1.20.0

v1.19.1

Compare Source

v1.18.2

Compare Source

What's Changed

• Updates the sampling code example in the README by @​viniciuscsouza in #​958
• Use redirect Uri passed in in demoInMemoryOAuthProvider by @​TylerLeonhardt in #​931
• fix(auth-router): correct Protected Resource Metadata for pathful RS and add explicit resourceServerUrl (RFC 9728) by @​blustAI in #​858
• chore: update version to 1.18.2 for weekly release by @​felixweinberger in #​970

New Contributors

• @​viniciuscsouza made their first contribution in #​958
• @​TylerLeonhardt made their first contribution in #​931
• @​blustAI made their first contribution in #​858

Full Changelog: modelcontextprotocol/typescript-sdk@1.18.1...1.18.2

v1.18.1

Compare Source

What's Changed

• fix: prevent streamable http wite after end from crashing the node process by @​MQ37 in #​933
• chore: update version to 1.18.1 for weekly release by @​felixweinberger in #​950

New Contributors

• @​MQ37 made their first contribution in #​933

Full Changelog: modelcontextprotocol/typescript-sdk@1.18.0...1.18.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.