Release notes from typescript-sdk
Articles about Release notes from typescript-sdk
Release 2.3.1 · modelcontextprotocol/typescript-sdk
Package Version @modelcontextprotocol/client 2.3.1 @modelcontextprotocol/server 2.3.1 @modelcontextprotocol/core 2.3.1 @modelcontextprotocol/server-legacy 2.3.1 @modelcontextprotocol/codemod 2.3.1 @modelcontextprotocol/node, express, hono, fastify unchanged Changes requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 added: it accepts only tokens issued for this server (the token's audience). Off unless you set it. (#2952)
Release @modelcontextprotocol/codemod@2.3.1 · modelcontextprotocol/typescript-sdk
The official TypeScript SDK for Model Context Protocol servers and clients - Release @modelcontextprotocol/codemod@2.3.1 · modelcontextprotocol/typescript-sdk
Release @modelcontextprotocol/server-legacy@2.3.1 · modelcontextprotocol/typescript-sdk
Patch Changes #2952 5a18673 Thanks @claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash.
Release @modelcontextprotocol/client@2.3.1 · modelcontextprotocol/typescript-sdk
Patch Changes Updated dependencies []: @modelcontextprotocol/core@2.3.1
Release 1.32.1 · modelcontextprotocol/typescript-sdk
What's Changed [v1.x] docs: state the principles in CLAUDE.md by @claude[bot] in #2939 [v1.x] docs: point the README at v2 and say what v1.x supports by @claude[bot] in #2942 chore: bump version to 1.32.1 by
Release 2.3.0 · modelcontextprotocol/typescript-sdk
Package Version @modelcontextprotocol/client 2.3.0 @modelcontextprotocol/server 2.3.0 @modelcontextprotocol/core 2.3.0 @modelcontextprotocol/server-legacy 2.3.0 @modelcontextprotocol/codemod 2.3.0 @modelcontextprotocol/node 2.1.1 @modelcontextprotocol/express, hono 2.0.2 @modelcontextprotocol/fastify 2.0.1 Upgrade notes One server per request. Server.connect() now rejects while the instance is already connected, and a stateless Streamable HTTP transport handles one request.
Release @modelcontextprotocol/express@2.0.2 · modelcontextprotocol/typescript-sdk
Patch Changes #2929 40f8f4e Thanks @claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash.
Release @modelcontextprotocol/server-legacy@2.3.0 · modelcontextprotocol/typescript-sdk
Patch Changes #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change. Updated dependencies [633dd3e]: @modelcontextprotocol/core@2.3.0
Release 1.32.0 · modelcontextprotocol/typescript-sdk
Upgrade notes Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
Release 2.2.0 · modelcontextprotocol/typescript-sdk
Package Version @modelcontextprotocol/client 2.2.0 @modelcontextprotocol/server 2.2.0 @modelcontextprotocol/core 2.2.0 @modelcontextprotocol/server-legacy 2.2.0 @modelcontextprotocol/codemod 2.2.0 @modelcontextprotocol/node, express, hono, fastify unchanged Upgrade notes Pass expectedIssuer to the machine-to-machine OAuth providers. Constructing ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or CrossAppAccessProvider without it is deprecated and logs a warning.
Release @modelcontextprotocol/server@2.2.0 · modelcontextprotocol/typescript-sdk
Patch Changes #2885 9dd722f Thanks @claude! - Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection (seen as unhandledrejection on Cloudflare Workers) in addition to the returned rejection. #2778 e3fb9ed Thanks @vjymisal0! - Fix a stack overflow in createMcpHandler when the factory returns the same server instance for more than one request. Returning a fresh instance per request is still required. #2651 c55efa6 Thanks
Release @modelcontextprotocol/client@2.2.0 · modelcontextprotocol/typescript-sdk
Minor Changes #2887 edd12e2 Thanks @maxisbey! - Constructing ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or CrossAppAccessProvider without expectedIssuer is deprecated: the constructor logs one console.warn and that call signature is marked @deprecated. Behaviour is otherwise unchanged. Pass the issuer of the authorization server the credentials were registered with.
Release @modelcontextprotocol/codemod@2.2.0 · modelcontextprotocol/typescript-sdk
Patch Changes #2582 f091897 Thanks @axits-lab! - The v1-to-v2 codemod now writes rewritten imports where the first v1 import stood, not at the top of the file, so a license header, // @ts-nocheck, /// or a 'use client' / 'use server' / 'use strict' directive above it stays in place. Known gap: when a later step of the codemod replaces or removes the import (for example a file whose only SDK import is ErrorCode or StreamableHTTPError), the new import can still land above or inside the header, and a /** */ header can be removed.
Release @modelcontextprotocol/server-legacy@2.2.0 · modelcontextprotocol/typescript-sdk
Patch Changes Updated dependencies [edd12e2]: @modelcontextprotocol/core@2.2.0
Release 1.31.0 · modelcontextprotocol/typescript-sdk
Upgrade notes Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it. Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated. What's Changed [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @maxisbey in #2888 chore: bump version to 1.31.0 by @claude[bot] in
Release 1.30.1 · modelcontextprotocol/typescript-sdk
What's Changed [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @maxisbey in #2717 fix(auth): preserve resource URI without trailing slash (#1968) by @MukundaKatta in
Release @modelcontextprotocol/server-legacy@2.1.0 · modelcontextprotocol/typescript-sdk
Patch Changes Updated dependencies [dcc0102]: @modelcontextprotocol/core@2.1.0
Release @modelcontextprotocol/server@2.1.0 · modelcontextprotocol/typescript-sdk
Minor Changes #1624 6032170 Thanks @SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks. createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup.
Release @modelcontextprotocol/client@2.1.0 · modelcontextprotocol/typescript-sdk
Minor Changes #2629 dcc0102 Thanks @gbshankar! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client. Opt in by implementing OAuthClientProvider.dpop() returning a DpopSession (new, along with generateDpopKeyPair, accessTokenHash, isDpopNonceChallenge).
Release @modelcontextprotocol/hono@2.0.1 · modelcontextprotocol/typescript-sdk
Patch Changes #2698 7b781ed Thanks @maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport