build(deps): bump github.com/modelcontextprotocol/go-sdk from 1.1.0 to 1.2.0

[dependabot]

Bumps github.com/modelcontextprotocol/go-sdk from 1.1.0 to 1.2.0.

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.2.0

This release is equivalent to v1.2.0-pre.2. Thank you to those who tested the prerelease.

This release adds partial support for the 2025-11-25 version of the MCP spec and fixes some bugs in the streamable transports. It also includes some minor new APIs, changes to contributing flows, and small bugfixes.

Contributing changes

• CONTRIBUTING.md is updated to remove the ad-hoc antitrust policy (#651), and add a dependency update policy (#635).
• An example server (examples/server/conformance) is added for the new conformance tests at modelcontextprotocol/conformance. Test can be run with scripts/conformance.sh (#650).

Partial support for the 2025-11-25 spec

The following SEPs from the 2025-11-25 spec are now supported. Please see modelcontextprotocol/go-sdk#725 for the proposed API additions included to support these SEPs.

• SEP-973: icons and metadata (modelcontextprotocol/go-sdk#570)
• SEP-986: tool name validation (modelcontextprotocol/go-sdk#640)
• SEP-1024: elicitation defaults (modelcontextprotocol/go-sdk#644)
• SEP-1036: URL mode elicitation (modelcontextprotocol/go-sdk#646)
• SEP-1699: SSE polling (modelcontextprotocol/go-sdk#663)
• SEP-1330: elicitation enum improvements (modelcontextprotocol/go-sdk#676)

Other API additions

• Common error codes are now available through the sentinel jsonrpc.Error (#452)
• OAuth 2.0 Protected Resource Metadata support (#643)
• ClientCapabilities.RootsV2 and RootCapabilities are added to work around an API bug (#607)
• Capabilities fields are added to ServerOptions and ClientOptions, to simplify capability configuration (#706)

Streamable fixes

Several bug fixes are included for the streamable transports:

• mcp: relax SSE connection response handling in non-strict mode by @​zhxie in modelcontextprotocol/go-sdk#611
• Fix: Skip non-message SSE events in processStream by @​raphaelmansuy in modelcontextprotocol/go-sdk#637
• mcp: better handling for streamable context cancellation by @​findleyr in modelcontextprotocol/go-sdk#677
• mcp: don't break the streamable client connection for transient errors by @​findleyr in modelcontextprotocol/go-sdk#723

Other notable bugfixes

• fix: handle Windows CRLF in MCP client by @​isfzhang in modelcontextprotocol/go-sdk#665
• auth, mcp: add UserID to TokenInfo for session hijacking prevention by @​findleyr in modelcontextprotocol/go-sdk#695
• internal/docs: document UserID for session hijacking prevention by @​findleyr in modelcontextprotocol/go-sdk#697
• mcp: allow re-using connections in more cases by @​howardjohn in modelcontextprotocol/go-sdk#709
• oauthex: validate URL schemes in auth server metadata and DCR by @​findleyr in modelcontextprotocol/go-sdk#712
• mcp: debounce server change notifications by @​findleyr in modelcontextprotocol/go-sdk#717
• oauthex: fix content type check in getJSON by @​nikolavp in modelcontextprotocol/go-sdk#721

New Contributors

• @​zhxie made their first contribution in modelcontextprotocol/go-sdk#611
• @​SpringMT made their first contribution in modelcontextprotocol/go-sdk#614

... (truncated)

Commits

• 411d5a0 mcp: switch icon theme to named string type (#733)
• 76e6854 docs: add GitHub Pages redirect to latest release documentation (#702)
• 875d1d3 mcp: don't break the streamable client connection for transient errors (#723)
• e009bac oauthex: fix content type check in getJSON (#721)
• 3430e22 mcp: add Capabilities fields to ServerOptions and ClientOptions (#713)
• bae0929 mcp: address review comments on streamable cleanup (#716)
• b3399e6 mcp: use args struct for CloseSSEStream (#718)
• 1a964ae mcp: debounce server change notifications (#717)
• a5e369e mcp: fix broken client root capabilities (#698)
• 307e32c oauthex: validate URL schemes in auth server metadata and DCR
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[AkihiroSuda]

https://github.com/lima-vm/lima/actions/runs/20448503639/job/58760691726?pr=4491

# ===== mcp =====
not ok 21 list tools in 150ms
# (from function `__assert_stream' in file hack/bats/lib/bats-assert/src/assert_output.bash, line 246,
#  from function `assert_output' in file hack/bats/lib/bats-assert/src/assert_output.bash, line 125,
#  from function `mcp' in file hack/bats/tests/mcp.bats, line 74,
#  from function `local_setup' in file hack/bats/tests/mcp.bats, line 42,
#  from function `call_local_function' in file hack/bats/tests/../helpers/load.bash, line 52,
#  from function `setup' in test file hack/bats/tests/../helpers/load.bash, line 69)
#   `call_local_function' failed
#
# -- output differs --
# expected : 1
# actual   : null
# --
#

lima/hack/bats/tests/mcp.bats

Lines 59 to 74 in 7c92565

	local request
	printf -v request '{"jsonrpc":"2.0","id":%d,"method":"%s"}' "$((++ID))" "$method"
	if [[ -n $params ]]; then
	request=$(json_edit ".params=${params}" <<<"$request")
	fi
	# send request to MCP server stdin
	echo "$request" >&"${MCP[1]}"
	# read response from MCP server stdout with 5s timeout
	local json
	read -t 5 -r json <&"${MCP[0]}"
	# verify that the response matches the request; also validates the output is valid JSON
	run_yq .id <<<"$json"
	assert_output "$ID"

[jandubois]

@AkihiroSuda:

With the go-sdk@1.2.0 we now get a notification before receiving the response to our request:

>>> {"jsonrpc":"2.0","id":2,"method":"tools/list"}
<<< {"jsonrpc":"2.0","method":"notifications/tools/list_changed","params":{}}

Notifications have a method field, but no id. We need to ignore them until we receive an actual response object.

[AkihiroSuda]

Thanks