[dependabot]

Updated Meziantou.Framework.Win32.CredentialManager from 3.0.5 to 3.0.7.

Release notes

Sourced from Meziantou.Framework.Win32.CredentialManager's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.WebAssembly from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Components.WebAssembly's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.WebAssembly.DevServer from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Components.WebAssembly.DevServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated ModelContextProtocol from 2.2.0 to 2.3.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. McpClient.ServerInfo is nullable — #​1903
   • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
   • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
   • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
   • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

• Correct protocol-version telemetry for stateless server spans #​1810 by @​luisangelrod
• Preserve HTTP errors and correct discovery fallback handling #​1791 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Make modern Streamable HTTP status mapping deterministic #​1837 by @​jstar0
  • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
• Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #​1852 by @​halter73 (co-authored by @​Copilot)
• Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #​1855 by @​scottt732
• Close server stdin before waiting for graceful stdio process exit #​1838 by @​luisangelrod
• Preserve insertion order when listing server tools, prompts, and resources #​1924 by @​PederHP (co-authored by Claude Opus 5.5)
• Allow missing optional server identity in discovery and make ServerInfo nullable #​1903 by @​Coding-Professional
• Include JSON parse details in Streamable HTTP 400 responses #​1844 by @​ump45nose
• Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #​1719 by @​halter73 (co-authored by @​Copilot)
  • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
  • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
• Preserve numeric progress tokens in RequestOptions serialization #​1832 by @​dfedoryshchev
• Dispose legacy SSE POST responses to release connections deterministically #​1841 by @​yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

• Document standing support for new MCP specification revisions #​1826 by @​halter73 (co-authored by @​Copilot)

Test Improvements

• Stabilize discovery-capable test connections while retaining initialization deadlines #​1943 by @​tarekgh

Repository Infrastructure Updates

• Add a source selector for manual documentation publishes #​1828 by @​jeffhandley (co-authored by @​Copilot)
• Update SourceLink's private build dependency to resolve a vulnerable Git dependency #​1873 by @​halter73 (co-authored by @​Copilot)
• Correct obsolete McpServerFactory references in Copilot instructions #​1892 by @​Zir0-93
• Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #​1940

Acknowledgements

• @​scottt732 made their first contribution in #​1855
• @​Zir0-93 made their first contribution in #​1892
• @​Coding-Professional made their first contribution in #​1903
  ... (truncated)

Commits viewable in compare view.

Updated ModelContextProtocol.AspNetCore from 2.2.0 to 2.3.0.

Updated System.CommandLine from 2.0.13 to 2.0.14.

Release notes

Sourced from System.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14.

Release notes

Sourced from System.Security.Cryptography.Pkcs's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[erikdarlingdata]

Dependabot patch-and-minor group. Base is dev (correct). One real thing to look at — ModelContextProtocol 2.2 → 2.3 is a documented minor-with-breaking: McpClient.ServerInfo is now Implementation? instead of Implementation. Noted inline. Everything else is routine dot bumps.

---

Generated by Claude Code

[erikdarlingdata]

Inline note on the one bump with a documented breaking change.

---

Generated by Claude Code

[erikdarlingdata]

MCP C# SDK 2.3.0 flips McpClient.ServerInfo from Implementation to Implementation? (release note #1903). The server side (src/PlanViewer.App/Mcp/McpHostService.cs:97 setting options.ServerInfo) is unaffected — that's the server advertising its own identity.

The client side has one unsafe dereference: tests/PlanViewer.Core.Tests/McpSmokeTests.cs:50

Assert.Equal("planview", client.ServerInfo.Name);

Studio's server populates ServerInfo on legacy initialize, which the release notes confirm still requires it, so this test should keep passing today. But client.ServerInfo can be null once a connection negotiates the 2026-07-28 protocol and the server omits optional identity — the .Name deref would then NRE instead of a clean assertion failure. Cheap fix:

Assert.Equal("planview", client.ServerInfo?.Name);

Nullable is enabled on this test project (PlanViewer.Core.Tests.csproj), so you may also see a new CS8602 warning here after the bump. Repo isn't warnings-as-errors in general (Directory.Build.props only promotes NU1903/NU1904), so it won't fail CI, but worth cleaning up in the same bump.

Also worth noting from the 2.3.0 notes for Studio's host (McpHostService.WithHttpTransport()): "Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout." If any of the plan_* tools block for a while before producing output, header delivery timing changes. Not a code change needed here — just something to watch if the next CI run shows timeout flakes.

---

Generated by Claude Code

[erikdarlingdata]

Review summary

What it does: Dependabot patch-and-minor group bump in Directory.Packages.props. Seven packages actually move in the diff (body lists nine; Microsoft.AspNetCore.Components.WebAssembly and .DevServer stayed at 10.0.13):

• Meziantou.Framework.Win32.CredentialManager 3.0.5 → 3.0.7
• Microsoft.AspNetCore.Mvc.Testing 10.0.13 → 10.0.14
• Microsoft.Data.Sqlite 10.0.13 → 10.0.14
• ModelContextProtocol 2.2.0 → 2.3.0
• ModelContextProtocol.AspNetCore 2.2.0 → 2.3.0
• System.CommandLine 2.0.13 → 2.0.14
• System.Security.Cryptography.Pkcs 10.0.13 → 10.0.14 (keeps the Issue Pin System.Security.Cryptography.Pkcs and MessagePack over vulnerable transitive versions, and make Dependabot see transitive packages #650 pin aligned with the 10.x runtime pack)

What's good:

• Targets dev, not main.
• Central package management only — no code churn.
• System.Security.Cryptography.Pkcs moves forward in step with the rest of the 10.0.x pins, so the GHSA-846f-f764-76mx / GHSA-2fmv-rv2c-59x7 pin keeps working. The MessagePack 2.5.307 pin stays put (correct — VSSDK still pulls 2.5.192).
• No Avalonia/XAML/ScottPlot/PlanAnalyzer surface touched, so none of the Studio-specific gotchas (AvaloniaEdit style include, ComboBox PlaceholderText, :pointerover template parts, muted-brush contrast, PlanAnalyzer/Monitor sync) apply.

What needs attention:

• MCP 2.3.0 has one documented breaking change (McpClient.ServerInfo is now nullable). Studio has one unsafe .Name deref in tests/PlanViewer.Core.Tests/McpSmokeTests.cs:50 that should become ?.Name. Details inline on Directory.Packages.props:38.
• Dependabot's body claims 9 updates but the diff shows 7. Harmless — the two WebAssembly entries didn't actually move, probably group resolution — but worth a glance before clicking merge.

Not approving or requesting changes — maintainer's call on whether to bundle the ?.Name fix with this bump or do it separately.

---

Generated by Claude Code