Bump mcp from 1.6.1 to 1.7.0

[dependabot]

Bumps mcp from 1.6.1 to 1.7.0.

Release notes

Sourced from mcp's releases.

v1.7.0

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

Changelog

Sourced from mcp's changelog.

[1.7.0] - 2026-10-05

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

Commits

• d4202c2 Merge pull request #588 from koic/release_1_7_0
• 6cb9875 Release 1.7.0
• 745bc61 Merge pull request #587 from koic/mark_removed_listen_streams_closed
• cc88656 Merge pull request #586 from koic/validate_icons_given_as_hashes
• 0cef024 Mark a removed subscriptions/listen stream closed
• 402cb56 Merge pull request #585 from koic/refuse_listen_requests_that_cannot_be_encoded
• 73d6da3 Merge pull request #584 from koic/describe_the_pending_authorization_checks_a...
• a49ab43 Validate icons given as Hashes through MCP::Icon
• 739dd55 Refuse subscriptions/listen requests that cannot be encoded
• 095bd81 [Doc] Describe the pending authorization checks as the code establishes them
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)