chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0

[dependabot]

Bumps github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0.

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.7.0-pre.3

This is a follow-up pre-release on top of v1.7.0-pre.2, still targeting protocol version 2026-07-28. It rounds out the previous pre-release with additional spec-compliance fixes, small ergonomic improvements to the streamable HTTP transport, and OAuth session persistence support.

Streamable HTTP request cancellation

The streamable HTTP transport now exposes an opt-in StreamableHTTPOptions.PropagateRequestCancellation flag. When enabled, aborting an in-flight POST cancels the handler context on stateless servers using the 2026-07-28 protocol, so long-running tool handlers can stop paying for orphaned work when the client goes away. Existing behavior is unchanged by default.

• mcp: allow opt-in to cancel handler ctx on aborted POST by @​guglielmo-san (#1099)

OAuth session persistence

Adds NewTokenSource and InitialTokenSource fields to AuthorizationCodeHandlerConfig. Together they let applications persist OAuth2 sessions across restarts by intercepting token refreshes and seeding the handler with a previously saved token source. A package example demonstrates the persistence pattern.

• auth: support OAuth2 session persistence by @​smlx (#1058)

Spec compliance fixes

Continued alignment with the spec adjustments for the 2026-07-28 protocol.

• mcp: update return meta in DiscoverResult (SEP-2575) by @​guglielmo-san (#1097)
• mcp: add return type to subscriptions/listen by @​guglielmo-san (#1088)
• mcp: reject calls to server/discover for <2026-07-28 requests by @​guglielmo-san (#1084)
• mcp: include resultType on new-protocol responses by @​ychampion (#1060)
• mcp: infer elicit mode from ElicitParams by @​guglielmo-san (#1078)
• mcp: wrap unmarshalParams errors with a JSON-RPC error by @​guglielmo-san (#1087)
• mcp: add param validation for CompleteResult by @​guglielmo-san (#1080)
• mcp: do not ApplyDefault when res.Content == nil by @​guglielmo-san (#1069)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags are added in this pre-release to restore the previous behavior of two spec-compliance fixes above.

• nowrapinvalidparams=1 — restore the previous behavior of returning raw unmarshalParams errors from receiving handlers instead of wrapping them as a JSON-RPC -32602 Invalid params error. Introduced by #1087.
• disablecompleteparamsvalidation=1 — restore the previous behavior of accepting completion/complete responses without validating the presence of the completion params object. Introduced by #1080.

Other Changes to the SDK

• docs: update docs by @​guglielmo-san (#1089)
• docs: update troubleshoot.md to include resultType by @​guglielmo-san (#1081)
• ci: fix nightly runs by @​guglielmo-san (#1086)

New Contributors

• @​ychampion made their first contribution in modelcontextprotocol/go-sdk#1060

Full Changelog: modelcontextprotocol/go-sdk@v1.7.0-pre.2...v1.7.0-pre.3

v1.7.0-pre.2

This is a follow-up pre-release on top of v1.7.0-pre.1, still targeting protocol version 2026-07-28. It rounds out the previous release with conformance-test coverage on both client and server, tightens spec compliance and introduces first-class support for custom JSON-RPC methods.

... (truncated)

Commits

• bc72835 mcp: fix potential nil-pointer dereference on message send (#1115)
• cc4db25 chore: update conformance (#1114)
• e761950 mcp: avoid double-copy of payload in writeEvent (#1106)
• 2781b8f mcp: derive Mcp-Protocol-Version header from the outgoing message (#1107)
• 827f90b mcp: allow opt-in to cancel handler ctx on aborted POST (#1099)
• 5cb8339 mcp: update return meta in DiscoverResult (SEP-2575) (#1097)
• fa548d7 docs: update docs (#1089)
• 8baa4cc mcp: add return type to subscriptions/listen (#1088)
• 9576afc mcp: wrap unmarshalParams with jsonrpc error (#1087)
• 0a8953d ci: fix nightly runs (#1086)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)