chore: Bump the minor-and-patch group with 1 update

[dependabot]

Updated ModelContextProtocol from 2.0.0-rc.1 to 2.0.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

1. Default to stateless HTTP and discovery-first negotiation #​1610
   • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
   • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
   • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
2. Deprecate Roots, Sampling, and Logging APIs #​1651
   • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
   • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
3. Move Tasks into ModelContextProtocol.Extensions.Tasks #​1693
   • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
   • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
4. Strengthen OAuth callback and issuer validation #​1605
   • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
   • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
5. Emit non-object structured tool results directly #​1568
   • Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
   • Update clients to read the value according to the advertised output schema rather than assuming a result property.
6. Require Tool.inputSchema during deserialization #​1600
   • Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
   • Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
7. Require explicit PKCE S256 support in OAuth metadata #​1700
   • OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
   • Update the authorization server metadata to declare PKCE S256 support.
8. Send application_type during dynamic client registration #​1613
   • Dynamic client registration requests now include an inferred application_type.
   • Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
9. Propagate underlying SSE connection exceptions #​1432
   • Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
   • Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
10. Fail OAuth step-up when a challenge makes no progress #​1591
    • A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
    • Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

• Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73
• Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
• Implement SEP-2243 HTTP header standardization #​1553 by @​mikekistler (co-authored by @​tarekgh @​Copilot)
• Append offline_access to authorization scope when advertised (SEP-2207) #​1479 by @​stephentoub (co-authored by @​Copilot)
• Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #​1558 by @​jayaraman-venkatesan
• Add APIs for pre-populating the McpClient tool cache #​1590 by @​tarekgh
• Add ScopeSelectorDelegate to OAuth options #​1596 by @​halllo
• Validate the authenticated user on Streamable HTTP session deletion #​1604 by @​halter73
  ... (truncated)

2.0.0-rc.2

This second 2.0 release candidate advances the SDK’s 2026-07-28 protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.

Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

1. Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #​1752
   • Aligns with protocol adjustment #​3002.
   • DiscoverResult.ServerInfo is removed; read and deserialize Meta[MetaKeys.ServerInfo] instead.
   • On 2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods with server/discover, _meta log level, and subscriptions/listen.
2. Validate OAuth authorization state #​1726
   • Custom authorization callback handlers must propagate the redirect state through AuthorizationResult.State, and should return Code, State, and Iss.
3. Fix SSE session transport shutdown behavior #​1432
   • Handle the underlying transport exception rather than depending on an IOException wrapper.

What's Changed

• Fix SSE session transport shutdown behavior #​1432 by @​xue-cai (co-authored by @​Copilot)
• Validate OAuth authorization state #​1726 by @​halter73 (co-authored by @​Copilot)
• Add configurable Tasks execution modes and complete conformance support #​1741 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Gate 2026-07-28 result fields by negotiated protocol version #​1753 by @​tarekgh
• Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #​1752 by @​pcarleton (co-authored by @​tarekgh @​Copilot)
• Reauthorize tools changed by call-tool filters #​1737 by @​PranavSenthilnathan (co-authored by @​Copilot)

Documentation Updates

• Refine 2.0.0 concept documentation #​1742 by @​jeffhandley (co-authored by @​Copilot)

Test Improvements

• Resolve test-server paths deterministically #​1735 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Add MCP Apps NativeAOT coverage #​1711 by @​lntutor
• Add MCP Apps _meta.ui serialization round-trip tests #​1698 by @​yayayouyou

Repository Infrastructure Updates

• Bump actions/setup-node from 6.4.0 to 7.0.0 #​1717
• Bump coverlet.collector from 10.0.0 to 10.0.1 #​1582
• Bump qs from 6.14.2 to 6.15.2 #​1597
• Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #​1716
• Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #​1569
• Bump actions/checkout from 6 to 7 #​1665
• Rename MCPEXP002 extensibility constants #​1739 by @​arimu1
• Bump the testing-frameworks group #​1746
• Bump the serilog-testing group #​1748
• Bump actions/checkout from 7.0.0 to 7.0.1 #​1745
• Bump Anthropic from 12.17.0 to 12.39.0 #​1750
• Bump OpenTelemetry and five other dependencies #​1747
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions