Bump ModelContextProtocol and ModelContextProtocol.AspNetCore - #19
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump ModelContextProtocol and ModelContextProtocol.AspNetCore#19dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
.NET
dependabot
Bot
force-pushed
the
dependabot/nuget/multi-001bfcb5b4
branch
from
June 27, 2026 17:21
854093d to
120568d
Compare
Bumps ModelContextProtocol from 1.3.0 to 1.4.0 Bumps ModelContextProtocol.AspNetCore from 1.3.0 to 1.4.0 --- updated-dependencies: - dependency-name: ModelContextProtocol dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: ModelContextProtocol.AspNetCore dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/nuget/multi-001bfcb5b4
branch
from
June 30, 2026 03:19
120568d to
c6abe8d
Compare
JoshuaRowePhantom
added a commit
that referenced
this pull request
Jul 16, 2026
…Connect token Private connect is identity-derived (design #19): the Management API's tunnel-name (list) path never mints a per-tunnel Connect token, so the resolver received a null token and threw 'The Management API did not return a Connect-scope tunnel token', breaking owner connect on the same machine/account. - DevTunnelEndpointResolver.ResolveAsync: stop throwing on a null Connect token in Private mode (identity-derived); the retired Token mode still requires a pre-shared token. - DevTunnelClientAuthorization: new helper that selects the tunnel-auth token — explicit Connect token verbatim, GitHub identity token + a 401-refresh resolver for Private when null, and no header for Anonymous. - EntityRepository.CreateDevTunnelNameDataAccessLayerAsync: authorize the Private tunnel-name path via the GitHub identity token when no Connect token is available, mirroring the WebRepositorySource UseGitHubAuthToken path. - docs/design/dev-tunnel-host-service.md: clarify design point #19. - Tests: replace the buggy ..._Throws unit test with DoesNotThrow / YieldsNullTunnelAuthToken / ConnectsAsOwner; add DevTunnelClientAuthorization tests; add the DevTunnelIntegrationTests owner-connect integration test; update the integration tests that codified the token-required behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pinned ModelContextProtocol at 1.4.0.
Release notes
Sourced from ModelContextProtocol's releases.
1.4.0
v1.4.0 introduces support for the Identity Assertion Authorization Grant (ID-JAG) flow via the new
IdentityAssertionGrantProvider, enabling enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider and access MCP servers without per-server authorization prompts. The release also adds a newInheritEnvironmentVariablesoption onStdioClientTransportOptionsfor controlling the child server's environment, alongside two security hardening fixes: the stdio client transport no longer enumerates child-process environment variables in Trace logs, andDELETEon a Streamable HTTP session now requires the same authenticated user that initiated the session.What's Changed
InheritEnvironmentVariablestoStdioClientTransportOptions#1563 by @halter73 (co-authored by @Copilot)HandleDeleteRequestAsyncnow mirrors theHasSameUserIdcheck already enforced on GET and POST. ADELETEwith a validMcp-Session-Idbut a different authenticated user now returns403 Forbiddeninstead of terminating the session — defense-in-depth against a leaked session ID being used to DoS the original owner.IdentityAssertionGrantProviderand supporting option/response types inModelContextProtocol.Authenticationimplementing the Identity Assertion Authorization Grant flow: RFC 8693 token exchange at the enterprise IdP (ID Token → JWT Authorization Grant) followed by RFC 7523 JWT bearer grant at the MCP authorization server (JAG → access token). See the new Cross-Application Access section in the transport docs for full usage details.Documentation Updates
Repository Infrastructure Updates
Acknowledgements
Full Changelog: modelcontextprotocol/csharp-sdk@v1.3.0...v1.4.0
Commits viewable in compare view.
Pinned ModelContextProtocol.AspNetCore at 1.4.0.
Release notes
Sourced from ModelContextProtocol.AspNetCore's releases.
1.4.0
v1.4.0 introduces support for the Identity Assertion Authorization Grant (ID-JAG) flow via the new
IdentityAssertionGrantProvider, enabling enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider and access MCP servers without per-server authorization prompts. The release also adds a newInheritEnvironmentVariablesoption onStdioClientTransportOptionsfor controlling the child server's environment, alongside two security hardening fixes: the stdio client transport no longer enumerates child-process environment variables in Trace logs, andDELETEon a Streamable HTTP session now requires the same authenticated user that initiated the session.What's Changed
InheritEnvironmentVariablestoStdioClientTransportOptions#1563 by @halter73 (co-authored by @Copilot)HandleDeleteRequestAsyncnow mirrors theHasSameUserIdcheck already enforced on GET and POST. ADELETEwith a validMcp-Session-Idbut a different authenticated user now returns403 Forbiddeninstead of terminating the session — defense-in-depth against a leaked session ID being used to DoS the original owner.IdentityAssertionGrantProviderand supporting option/response types inModelContextProtocol.Authenticationimplementing the Identity Assertion Authorization Grant flow: RFC 8693 token exchange at the enterprise IdP (ID Token → JWT Authorization Grant) followed by RFC 7523 JWT bearer grant at the MCP authorization server (JAG → access token). See the new Cross-Application Access section in the transport docs for full usage details.Documentation Updates
Repository Infrastructure Updates
Acknowledgements
Full Changelog: modelcontextprotocol/csharp-sdk@v1.3.0...v1.4.0
Commits viewable in compare view.