[dependabot]

Bumps rmcp from 3.7.0 to 3.9.0.

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.9.0

Other

• add Voltip to built with rmcp list (#1401)

rmcp-v3.9.0

Added

• (auth) structure protected resource discovery errors (#1305)
• (transport) log followed same-origin redirects at debug level (#1417)
• support the Skills extension (SEP-2640) (#1392)

Fixed

• (model) don't treat _meta alone as a CallToolResult (#1405)
• (client) keep ProgressDispatcher lock off the await path (#1310)
• (auth) refresh with only granted scopes (#1331)
• streamable-http server: stateful session workers ignore config.canc (#1427)
• (skills) enforce manifest boundaries and capability negotiation (#1412)
• (transport) send SIGTERM before killing a child process on graceful shutdown (#1379)
• (handler) generate a tool's outputSchema for the serialize contract (#1378)
• (server) reject server-to-client requests on discover sessions (#1397)
• (auth) accept ID-JAGs without a resource claim (#1406)
• (rmcp) reject Mcp-Param headers with invalid characters (#1414)
• (transport) match explicit HTTP media types and Accept quality values (#1382)
• (model) accept URL elicitation requests without elicitationId (#1383)
• (transport) preserve protocol error replies across cancellation (#1370)

Other

• (transport) fix spell-check failures in response-limit tests (#1432)
• Merge commit from fork
• (deps) update rstest requirement from 0.27.0 to 0.28.0 (#1422)
• (client) point on_*_list_changed callbacks to Peer::listen (#1402)
• add Voltip to built with rmcp list (#1401)

rmcp-macros-v3.8.0

Fixed

• (transport) accept nested x-mcp-header annotations (#1359)
• ship LICENSE in rmcp and rmcp-macros crates (#1342)

Other

• combine AI issue triage with a maintainer rotation as the responsible reviewer (#1260)

rmcp-v3.8.0

Added

• (transport) expose body-free HTTP status errors (#1386)

... (truncated)

Commits

• 5596a8a chore: release v3.9.0 (#1403)
• 429524d fix(model): don't treat _meta alone as a CallToolResult (#1405)
• e7d201f test(transport): fix spell-check failures in response-limit tests (#1432)
• 3e0156c Merge commit from fork
• d66a74d fix(client): keep ProgressDispatcher lock off the await path (#1310)
• 09d29d9 fix(auth): refresh with only granted scopes (#1331)
• 8878a79 fix: streamable-http server: stateful session workers ignore config.canc (#1427)
• 3fc54d0 fix(skills): enforce manifest boundaries and capability negotiation (#1412)
• b166e81 fix(transport): send SIGTERM before killing a child process on graceful shutd...
• df2af23 fix(handler): generate a tool's outputSchema for the serialize contract (#1378)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.