Skip to content

Bump the test-dependencies group with 2 updates - #43

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/OKF4net.Agents/test-dependencies-33524eb5e5
Open

Bump the test-dependencies group with 2 updates#43
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/OKF4net.Agents/test-dependencies-33524eb5e5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor

Updated Microsoft.Agents.AI from 1.15.0 to 1.16.0.

Release notes

Sourced from Microsoft.Agents.AI's releases.

1.16.0

What's Changed

New Contributors

Full Changelog: microsoft/agent-framework@python-github-copilot-1.0.0...dotnet-1.16.0

Commits viewable in compare view.

Updated ModelContextProtocol from 2.0.0-rc.2 to 2.0.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

  1. Default to stateless HTTP and discovery-first negotiation #​1610
    • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
    • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
    • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
  2. Deprecate Roots, Sampling, and Logging APIs #​1651
    • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
    • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
  3. Move Tasks into ModelContextProtocol.Extensions.Tasks #​1693
    • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
    • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
  4. Strengthen OAuth callback and issuer validation #​1605
    • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
    • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
  5. Emit non-object structured tool results directly #​1568
    • Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
    • Update clients to read the value according to the advertised output schema rather than assuming a result property.
  6. Require Tool.inputSchema during deserialization #​1600
    • Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
    • Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
  7. Require explicit PKCE S256 support in OAuth metadata #​1700
    • OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
    • Update the authorization server metadata to declare PKCE S256 support.
  8. Send application_type during dynamic client registration #​1613
    • Dynamic client registration requests now include an inferred application_type.
    • Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
  9. Propagate underlying SSE connection exceptions #​1432
    • Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
    • Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
  10. Fail OAuth step-up when a challenge makes no progress #​1591
    • A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
    • Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

  • Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73
  • Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
  • Implement SEP-2243 HTTP header standardization #​1553 by @​mikekistler (co-authored by @​tarekgh @​Copilot)
  • Append offline_access to authorization scope when advertised (SEP-2207) #​1479 by @​stephentoub (co-authored by @​Copilot)
  • Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #​1558 by @​jayaraman-venkatesan
  • Add APIs for pre-populating the McpClient tool cache #​1590 by @​tarekgh
  • Add ScopeSelectorDelegate to OAuth options #​1596 by @​halllo
  • Validate the authenticated user on Streamable HTTP session deletion #​1604 by @​halter73
    ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the test-dependencies group with 2 updates
c861dec 
Bumps Microsoft.Agents.AI from 1.15.0 to 1.16.0
Bumps ModelContextProtocol from 2.0.0-rc.2 to 2.0.0

---
updated-dependencies:
- dependency-name: Microsoft.Agents.AI
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-dependencies
- dependency-name: ModelContextProtocol
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 4, 2026
@dependabot
dependabot Bot requested a review from jchable as a code owner August 4, 2026 10:09
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jchable jchable Awaiting requested review from jchable jchable is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants