[dependabot]

Updated ModelContextProtocol from 2.3.0 to 2.4.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.4.0

Version 2.4.0 adds experimental MCP Skills support through the new ModelContextProtocol.Extensions.Skills package, alongside OAuth hardening and reliability improvements for transport, session, and discovery flows. MCP Apps also now match protocol property names case-sensitively.

What's Changed

• Add the experimental MCP Skills extension #​1856 by @​girishkvs (co-authored by @​PederHP)
• Align Skills with server primitives and typed request handlers #​1993 by @​halter73 (co-authored by @​Copilot)
• Require explicit opt-in for the legacy OAuth metadata fallback #​1952 by @​halter73 (co-authored by @​Copilot)
• Preserve refresh tokens when OAuth refresh responses omit replacements #​1968 by @​halter73 (co-authored by @​Copilot)
• Preserve canonical OAuth resource identifiers during refresh #​1967 by @​halter73 (co-authored by @​Copilot)
• Fix cancellation being reported as missing OAuth metadata #​1891 by @​Empiree
• Cancel open subscriptions/listen requests when the transport stops delivering messages #​1933 by @​pournasserian (co-authored by @​Copilot)
• Fix dropped notifications and cancellation when a request is canceled #​1917 by @​zerotohero3
• Prevent server/discover probes from committing the negotiated protocol version #​1956 by @​PrathmeshPawar2110 (co-authored by @​claude)
• Fall back to SSE when AutoDetect receives a 405 with a JSON-RPC error body #​1849 by @​ump45nose
• Fix legacy output schemas for delegating server tools #​1928 by @​Oxygen56
• Match protocol property names case-sensitively #​1934 by @​FenjuFu

Documentation Updates

• Clarify Skills discovery and documentation #​2000 by @​halter73 (co-authored by @​Copilot)
• Fix Markdown link-check warnings and update the Skills specification link #​1975 by @​jeffhandley (co-authored by @​Copilot)

Test Improvements

• Prevent discovery probe timeouts in controlled test connections #​1946 by @​tarekgh
• Apply test discovery timeouts to Sampling_Stdio #​1950 by @​girishkvs
• Use a task that runs until cancelled in the task store cancellation test #​1955 by @​girishkvs
• Fix parallel integration test server startup #​1982 by @​jeffhandley (co-authored by @​Copilot)

Repository Infrastructure Updates

• Bump fast-uri from 3.1.5 to 3.1.7 #​1850
• Bump actions/deploy-pages from 5.0.0 to 5.0.1 #​1858
• Support release-line docs publishing and release coordination #​1972 by @​jeffhandley (co-authored by @​Copilot)
• Bump docfx from 2.78.5 to 2.81.0 #​1961
• Bump actions/setup-node from 7.0.0 to 7.1.0 #​1927
• Bump becheran/mlc from 1.2.0 to 1.3.0 #​1907
• Bump the other-testing group with 2 updates #​1960
• Bump actions/download-artifact from 8.0.1 to 8.0.2 #​1926
• Bump Anthropic from 12.40.0 to 13.3.0 #​1962
• Bump the opentelemetry-testing group with 6 updates #​1959
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 #​1925
• Fix CI selection of patched .NET SDKs #​1995 by @​tarekgh

Acknowledgements

• @​Empiree made their first contribution in #​1891
• @​zerotohero3 made their first contribution in #​1917
• @​girishkvs made their first contribution in #​1856
• @​FenjuFu made their first contribution in #​1934
  ... (truncated)

2.3.1

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

• Harden authenticated stateful MCP sessions (commit bfbd893) by @​halter73 (co-authored by @​Copilot @​jeffhandley @​tarekgh)

Repository Infrastructure Updates

• Align docs publishing with shared orchestration #​1981 by @​jeffhandley (co-authored by @​Copilot)
• Fix Markdown link-check warnings and outdated Skills specification link #​1979 by @​jeffhandley (co-authored by @​Copilot)

Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1

[!NOTE]
These release notes were drafted with GitHub Copilot.

Commits viewable in compare view.

Updated ModelContextProtocol.AspNetCore from 2.3.0 to 2.4.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)