Bump the mcp-deps group across 2 directories with 1 update

[dependabot]

Bumps the mcp-deps group with 1 update in the /projects/mcp/brave directory: io.modelcontextprotocol:kotlin-sdk.
Bumps the mcp-deps group with 1 update in the /projects/mcp/mcp-demo directory: io.modelcontextprotocol:kotlin-sdk.

Updates io.modelcontextprotocol:kotlin-sdk from 0.14.0 to 0.15.0

Release notes

Sourced from io.modelcontextprotocol:kotlin-sdk's releases.

0.15.0

Description

This release makes inbound message handling concurrent after the initialization handshake, adds SSE heartbeats and elicitation schema validation, and fixes several Streamable HTTP response and session-lifecycle bugs.

Breaking Changes

Concurrent inbound dispatch by @​devcrocod in #884

Inbound messages were processed serially on the transport read loop, so one slow or peer-awaiting handler (sampling, elicitation, roots) blocked every later message on the connection, including the responses and notifications/cancelled those handlers depend on. After the handshake, handlers may now run concurrently; processing stays serial during initialization.

• ProtocolOptions / ClientOptions / ServerOptions gain a handlerCoroutineContext parameter (defaults to Dispatchers.Default). Concurrency is bounded internally; there is no opt-out flag by design.
• RequestHandlerExtra is now a CoroutineContext.Element and is no longer user-constructible. It exposes requestId, method, sendRequest, and sendNotification, and can be read inside a handler via the new currentRequestHandlerExtra().

- val extra = RequestHandlerExtra()
+ val extra = currentRequestHandlerExtra()

Duplicate feature names are rejected at registration by @​devcrocod in #883

addTool/addPrompt/addResource/addResourceTemplate silently replaced an existing entry and emitted a spurious list_changed notification. They now throw IllegalArgumentException and leave the existing registration intact. The batch variants (addTools/addPrompts/addResources) are all-or-nothing. To replace a feature, remove it first.

- server.addTool(name = "search", ...)  // silently overwrote
+ server.removeTool("search")
+ server.addTool(name = "search", ...)

eventStore removed from mcpStatelessStreamableHttp by @​devcrocod in #909

The parameter was never read or written: a stateless endpoint answers GET with 405, so no stream exists to store or replay events on. The old overload is retained at DeprecationLevel.ERROR with a ReplaceWith migration hint. Use mcpStreamableHttp when you need resumability.

  application.mcpStatelessStreamableHttp(
      path = "/mcp",
-     eventStore = myEventStore,
  ) { server }

Features

• Optional SSE heartbeats for Streamable HTTP servers via mcpStreamableHttp(sseHeartbeatConfig = { ... }), keeping long-lived streams alive against clients that disconnect on idle. Heartbeats stay off by default, by @​UnscientificJsZhai in #761
• Accepted form-mode elicitation content is now validated against requestedSchema; a mismatch fails createElicitation with McpException (INVALID_PARAMS) instead of reaching server code unchecked, by @​rea9r in #896
• The Streamable HTTP client now sends the standard Mcp-Method and Mcp-Name POST headers, by @​AndreKalberer in #894

Fixed

• Stateless Streamable HTTP now closes its per-request session, fixing unbounded growth of the session registry and notification subscriptions, by @​KlyneChrysler in #872
• Streamable HTTP responses keep their status and body when the client accepts only text/event-stream, by @​devcrocod in #911

... (truncated)

Commits

• 76b8e7d release: 0.15.0 (#918)
• dab340f fix(server): drop inert eventStore from stateless Streamable HTTP (#909)
• 24c3cd3 fix(server): match Accept header as media ranges (#912)
• 7fa438c feat(client): send MCP standard POST headers (#894)
• 94745e6 chore(deps): bump the kotest group across 1 directory with 3 updates (#915)
• 2b494b7 chore(deps): bump the other-dependencies group across 5 directories with 3 up...
• 82fe56e fix(server): preserve Streamable HTTP response status and body (#911)
• a06d699 feat: SSE heartbeat (#761)
• cab669b fix: classify malformed request params as invalid params (#886)
• b6cb547 fix(server): preserve id on duplicate initialize errors (#868)
• Additional commits viewable in compare view

Updates io.modelcontextprotocol:kotlin-sdk from 0.14.0 to 0.15.0

Release notes

Sourced from io.modelcontextprotocol:kotlin-sdk's releases.

0.15.0

Description

This release makes inbound message handling concurrent after the initialization handshake, adds SSE heartbeats and elicitation schema validation, and fixes several Streamable HTTP response and session-lifecycle bugs.

Breaking Changes

Concurrent inbound dispatch by @​devcrocod in #884

Inbound messages were processed serially on the transport read loop, so one slow or peer-awaiting handler (sampling, elicitation, roots) blocked every later message on the connection, including the responses and notifications/cancelled those handlers depend on. After the handshake, handlers may now run concurrently; processing stays serial during initialization.

• ProtocolOptions / ClientOptions / ServerOptions gain a handlerCoroutineContext parameter (defaults to Dispatchers.Default). Concurrency is bounded internally; there is no opt-out flag by design.
• RequestHandlerExtra is now a CoroutineContext.Element and is no longer user-constructible. It exposes requestId, method, sendRequest, and sendNotification, and can be read inside a handler via the new currentRequestHandlerExtra().

- val extra = RequestHandlerExtra()
+ val extra = currentRequestHandlerExtra()

Duplicate feature names are rejected at registration by @​devcrocod in #883

addTool/addPrompt/addResource/addResourceTemplate silently replaced an existing entry and emitted a spurious list_changed notification. They now throw IllegalArgumentException and leave the existing registration intact. The batch variants (addTools/addPrompts/addResources) are all-or-nothing. To replace a feature, remove it first.

- server.addTool(name = "search", ...)  // silently overwrote
+ server.removeTool("search")
+ server.addTool(name = "search", ...)

eventStore removed from mcpStatelessStreamableHttp by @​devcrocod in #909

The parameter was never read or written: a stateless endpoint answers GET with 405, so no stream exists to store or replay events on. The old overload is retained at DeprecationLevel.ERROR with a ReplaceWith migration hint. Use mcpStreamableHttp when you need resumability.

  application.mcpStatelessStreamableHttp(
      path = "/mcp",
-     eventStore = myEventStore,
  ) { server }

Features

• Optional SSE heartbeats for Streamable HTTP servers via mcpStreamableHttp(sseHeartbeatConfig = { ... }), keeping long-lived streams alive against clients that disconnect on idle. Heartbeats stay off by default, by @​UnscientificJsZhai in #761
• Accepted form-mode elicitation content is now validated against requestedSchema; a mismatch fails createElicitation with McpException (INVALID_PARAMS) instead of reaching server code unchecked, by @​rea9r in #896
• The Streamable HTTP client now sends the standard Mcp-Method and Mcp-Name POST headers, by @​AndreKalberer in #894

Fixed

• Stateless Streamable HTTP now closes its per-request session, fixing unbounded growth of the session registry and notification subscriptions, by @​KlyneChrysler in #872
• Streamable HTTP responses keep their status and body when the client accepts only text/event-stream, by @​devcrocod in #911

... (truncated)

Commits

• 76b8e7d release: 0.15.0 (#918)
• dab340f fix(server): drop inert eventStore from stateless Streamable HTTP (#909)
• 24c3cd3 fix(server): match Accept header as media ranges (#912)
• 7fa438c feat(client): send MCP standard POST headers (#894)
• 94745e6 chore(deps): bump the kotest group across 1 directory with 3 updates (#915)
• 2b494b7 chore(deps): bump the other-dependencies group across 5 directories with 3 up...
• 82fe56e fix(server): preserve Streamable HTTP response status and body (#911)
• a06d699 feat: SSE heartbeat (#761)
• cab669b fix: classify malformed request params as invalid params (#886)
• b6cb547 fix(server): preserve id on duplicate initialize errors (#868)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, mcp. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.