[renovate]

Merge #4478 first, followed by #4526, #4510, #4524, #4489, #4485, #4527, #4528, #4530, #4531, #4529, #4534, and #4541.

This PR is number 1 of 13, based on master. Merge #4526 next.

#4521 has already merged into this branch.

Use merge commits. After merging a parent PR, change its child's base to master before merging the child. Auto-merge is disabled.

Update @modelcontextprotocol/client from 2.3.1 to 2.4.0 and rebuild the embedded extension bundles.

Package	Change	Age	Confidence
@modelcontextprotocol/client (source)	2.3.1 → 2.4.0

Upstream release notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/client)

v2.4.0

Compare Source

Minor Changes

• #​3057 c05225a Thanks @​steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

• #​3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

• #​3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

• #​2960 43c45f4 Thanks @​claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.

• #​3081 5820f79 Thanks @​claude! - A tool outputSchema whose root is a $ref to a type: "object" entry of its own $defs or definitions (what zod writes for z.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema and structuredContent are no longer wrapped in { result: ... }, so a 2025-era client that read structuredContent.result for such a tool now reads structuredContent. On every era the advertised schema gains type: "object" at its root.

• #​3057 c05225a Thanks @​steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.

• #​3005 b381559 Thanks @​chaeyn! - Reflect resource and resource template update({ title }) changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.

• #​3002 895007f Thanks @​Hugo-DDT! - createMcpHandler now sends Allow: POST on every 405 it answers to a non-POST request, with legacy: 'stateless' (the default) and with legacy: 'reject'.

• #​2762 b022522 Thanks @​pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @​modelcontextprotocol/core@2.4.0

Renovate settings

Renovate can create this branch at any time. No auto-merge schedule is set. Auto-merge is disabled, so merge the PR manually after review.

Renovate rebases the branch when it conflicts or when you select the checkbox below. Close this PR to stop reminders for this update.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Session scheduler repair

Commit dc524ef9 fixes a lost convergence pass found during the Linux fleet failure in refresh_begins_at_the_committed_frontier_after_background_summaries_publish.

During summary processing, temporal projection could consume a wake while the current summary page still used earlier inputs. If neither operation reported more work, the worker went idle without another convergence pass. The worker now retains the needed pass locally and requeues it after the running page finishes. Both successful completion paths share that step. Admission and cancellation behavior stay unchanged.

Repair validation

• The controlled regression failed before the fix because convergence did not run, then passed after the fix. It also covers admission, cancellation, and avoiding repeated projection while a page is pending.
• The original LCM test that failed in CI passed unchanged.
• All 167 session-runtime library tests passed, with none failed or ignored, using Cargo on the pinned nightly.
• The first full run failed four profile-store fixtures because the filesystem authority rejects the cloud host's overlay filesystem. An isolated directory on supported tmpfs let those four pass, followed by a full run with all 167 tests passing.
• Pinned Rust formatting and git diff --check passed.

The recorded test command was:

cargo test --locked -p tracedecay-session-runtime \
  --features tracedecay-rusqlite-runtime/test-runtime \
  --lib -- --test-threads=1

Compilation used one job, no debug information or incremental compilation, no test optimization, and 256 codegen units for asupersync. The final run set TMPDIR to its isolated fixture directory.

Readiness fixture validation

At be21c0c070c591d9b20b5072d1f1c9edf611ae9c, canonical Bazel runtime acceptance passed 139 tests, with the affected formatting check. Invocation: 60a5ed65-4329-4943-b174-a4bc6d043094. The readiness wait uses the existing status authority and readiness budget before pagination assertions. The earlier d6cd8688 exact and full-suite passes remain historical; this result covers the correction.

[changeset-bot]

⚠️ No Changeset found

Latest commit: be21c0c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.