fix(deps): update module github.com/modelcontextprotocol/go-sdk to v1.3.1 [security]#48
Open
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.1.0→v1.3.1GitHub Vulnerability Alerts
CVE-2026-27896
The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. Additionally, Go's standard library folds the Unicode characters ſ (U+017F) and K (U+212A) to their ASCII equivalents s and k, meaning fields like "paramſ" would match "params". This violated the JSON-RPC 2.0 specification, which defines exact field names.
Impact:
A malicious MCP peer may have been able to send protocol messages with non-standard field casing (e.g., "Method" instead of "method") that the SDK would silently accept. This had the potential for:
Fix:
Go's standard JSON unmarshaling was replaced with a case-sensitive decoder (github.com/segmentio/encoding) in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.
Credits:
MCP Go SDK thanks Francesco Lacerenza (Doyensec) for reporting this issue.
Release Notes
modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)
v1.3.1Compare Source
This release is a patch release for v1.3.0.
It contains a cherry-pick for a security issue reported in #805, which takes advantage of the default behavior of Go's standard library JSON decoder that allows case-insensitive matches to struct field names (or "json" tags). The issue has been addressed by changing the JSON decoder to one that supports case sensitive matching.
Fixes
New external dependencies
Full Changelog: modelcontextprotocol/go-sdk@v1.3.0...v1.3.1
v1.3.0Compare Source
This release is equivalent to v1.3.0-pre.1. Thank you to those who tested the pre-release.
This release includes several enhancements and bugfixes. Worth mentioning is the addition of schema caching, which significantly improves the performance in some stateless server deployment scenarios.
Dependency updates
Enhancements
Bugfixes
Chores
New Contributors
Full Changelog: modelcontextprotocol/go-sdk@v1.2.0...v1.3.0
v1.2.0Compare Source
This release is equivalent to v1.2.0-pre.2. Thank you to those who tested the prerelease.
This release adds partial support for the 2025-11-25 version of the MCP spec and fixes some bugs in the streamable transports. It also includes some minor new APIs, changes to contributing flows, and small bugfixes.
Contributing changes
examples/server/conformance) is added for the new conformance tests at modelcontextprotocol/conformance. Test can be run withscripts/conformance.sh(#650).Partial support for the 2025-11-25 spec
The following SEPs from the 2025-11-25 spec are now supported. Please see #725 for the proposed API additions included to support these SEPs.
Other API additions
jsonrpc.Error(#452)ClientCapabilities.RootsV2and RootCapabilities are added to work around an API bug (#607)Capabilitiesfields are added toServerOptionsandClientOptions, to simplify capability configuration (#706)Streamable fixes
Several bug fixes are included for the streamable transports:
Other notable bugfixes
New Contributors
Full Changelog: modelcontextprotocol/go-sdk@v1.1.0...v1.2.0
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.