lefthook merge commit

Author: KKonstantinov

.changeset/README.md

@@ -0,0 +1,6 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works with multi-package repos, or single-package repos to help you version and publish your code. You can find the full documentation for it
+[in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in [our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/brave-lions-glow.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/node': patch
+---
+
+Prevent Hono from overriding global Response object by passing `overrideGlobalObjects: false` to `getRequestListener()`. This fixes compatibility with frameworks like Next.js whose response classes extend the native Response.

.changeset/busy-weeks-hang.md

@@ -0,0 +1,6 @@
+---
+'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/server': patch
+---
+
+Fix ReDoS vulnerability in UriTemplate regex patterns (CVE-2026-0621)

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+    "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+    "changelog": ["@changesets/changelog-github", { "repo": "modelcontextprotocol/typescript-sdk" }],
+    "commit": false,
+    "fixed": [],
+    "linked": [],
+    "access": "public",
+    "baseBranch": "main",
+    "updateInternalDependencies": "patch",
+    "ignore": ["@modelcontextprotocol/examples-client", "@modelcontextprotocol/examples-server", "@modelcontextprotocol/examples-shared"]
+}

.changeset/cyan-cycles-pump.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/server': patch
+---
+
+missing change for fix(client): replace body.cancel() with text() to prevent hanging

.changeset/funky-baths-attack.md

@@ -0,0 +1,8 @@
+---
+'@modelcontextprotocol/node': patch
+'@modelcontextprotocol/test-integration': patch
+'@modelcontextprotocol/server': patch
+'@modelcontextprotocol/core': patch
+---
+
+remove deprecated .tool, .prompt, .resource method signatures

.changeset/heavy-walls-swim.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/server': patch
+---
+
+reverting application/json in notifications

.changeset/oauth-error-http200.md

@@ -0,0 +1,7 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Fix OAuth error handling for servers returning errors with HTTP 200 status
+
+Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

.changeset/respect-capability-negotiation.md

@@ -0,0 +1,14 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Respect capability negotiation in list methods by returning empty lists when server lacks capability
+
+The Client now returns empty lists instead of sending requests to servers that don't advertise the corresponding capability:
+
+- `listPrompts()` returns `{ prompts: [] }` if server lacks prompts capability
+- `listResources()` returns `{ resources: [] }` if server lacks resources capability
+- `listResourceTemplates()` returns `{ resourceTemplates: [] }` if server lacks resources capability
+- `listTools()` returns `{ tools: [] }` if server lacks tools capability
+
+This respects the MCP spec requirement that "Both parties SHOULD respect capability negotiation" and avoids unnecessary server warnings and traffic. The existing `enforceStrictCapabilities` option continues to throw errors when set to `true`.

.changeset/shy-times-learn.md

@@ -0,0 +1,8 @@
+---
+'@modelcontextprotocol/node': patch
+'@modelcontextprotocol/test-integration': patch
+'@modelcontextprotocol/server': patch
+'@modelcontextprotocol/core': patch
+---
+
+deprecated .tool, .prompt, .resource method removal