fix(deps): update dependency @modelcontextprotocol/sdk to v1.24.0

[ibm-mend-app]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.20.1 -> 1.24.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.1	CVE-2025-66414
Medium	5.8	CVE-2025-13466

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.24.0

Compare Source

Summary

This release brings us up to speed with the latest MCP spec 2025-11-25. Take a look at the latest spec as well as the release blog post.

What's Changed

• fix: update spec links from latest to draft by @​domdomegg in https://github.com/modelcontextprotocol/typescript-sdk/pull/1171
• Make sure to consume HTTP error response bodies by @​GreenStage in https://github.com/modelcontextprotocol/typescript-sdk/pull/1173
• docs: add GET request handling for streamableHttp stateless mode by @​saharis9988 in https://github.com/modelcontextprotocol/typescript-sdk/pull/1161
• SEP-1686: Tasks by @​LucaButBoring in https://github.com/modelcontextprotocol/typescript-sdk/pull/1041
• Fix JSON parse error on SSE events with empty data by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1184
• Fix StreamableHTTPClientTransport instantiation by @​yuwzho in https://github.com/modelcontextprotocol/typescript-sdk/pull/944
• feat: eslint rule to prefer node protocols by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1187
• fix: call tasks/result to deliver side-channel messages by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1185
• Add invalid_target oauth error (rfc 8707) by @​GreenStage in https://github.com/modelcontextprotocol/typescript-sdk/pull/1183
• fix(client): use StreamableHTTPError instead of plain Error in send() by @​yamadashy in https://github.com/modelcontextprotocol/typescript-sdk/pull/1178
• coerce 'expires_in' to be a number by @​adam-kuhn in https://github.com/modelcontextprotocol/typescript-sdk/pull/1111
• Allow HTTP issuer URLs when MCP_DEV_MODE is enabled by @​jerome3o-anthropic in https://github.com/modelcontextprotocol/typescript-sdk/pull/1189
• fix: update registerTool signature for proper typed ToolCallback by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1188
• SEP-1046: Client credentials flow for M2M without user interaction by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1157
• adds the transitive @​types/express-serve-static-core dependency as a direct devDependency by @​mgyarmathy in https://github.com/modelcontextprotocol/typescript-sdk/pull/1078
• Fix optional argument handling in prompts for Zod V4 by @​filip-bartuska-ipf in https://github.com/modelcontextprotocol/typescript-sdk/pull/1199
• fix hanging stdio servers by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1200
• README refactor by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1197
• [Docs] Fix typo by @​koic in https://github.com/modelcontextprotocol/typescript-sdk/pull/1067
• feat: add closeSSEStream callback to RequestHandlerExtra by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1166
• fix: improve SSE reconnection behavior by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1191
• fix: normalize headers in sse transport by @​marcrasi in https://github.com/modelcontextprotocol/typescript-sdk/pull/856
• feat: add closeStandaloneSSEStream for GET stream polling by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1203
• fix: normalize null to undefined in ElicitResultSchema content field by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1204
• Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection. by @​jacopoc in https://github.com/modelcontextprotocol/typescript-sdk/pull/1205
• fix: allow zod 4 transformations by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1213
• feat: backwards-compatible createMessage overloads for SEP-1577 by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1212
• chore: bump version for release by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1215

New Contributors

• @​GreenStage made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1173
• @​saharis9988 made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1161
• @​yuwzho made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/944
• @​yamadashy made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1178
• @​adam-kuhn made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1111
• @​mgyarmathy made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1078
• @​filip-bartuska-ipf made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1199
• @​koic made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1067
• @​marcrasi made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/856
• @​jacopoc made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1205

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.24.0

v1.23.1

Compare Source

Fixed:

• Disabled SSE priming events to fix backwards compatibility - 1.23.x clients crash on empty SSE data (JSON.parse(""))

This is a patch for servers still on 1.23.x that were breaking clients not handling the the 2025-11-25 priming event behavior with empty SSE data fields. See https://github.com/modelcontextprotocol/typescript-sdk/pull/1233 for more details.

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.23.1

v1.23.0

Compare Source

What's Changed

• Migrate to vitest from jest by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1074
• ci: add workflow_dispatch trigger for manual CI runs by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1114
• Fix: @​types/node incompatibility with vite warnings on npm install by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1121
• Fix: clean up accidental spec.types.ts by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1122
• fix: Pass RequestInit options to auth requests by @​dsp-ant in https://github.com/modelcontextprotocol/typescript-sdk/pull/1066
• SEP-1036: URL Elicitation by @​nbarbettini in https://github.com/modelcontextprotocol/typescript-sdk/pull/1105
• add none to test and the router. by @​m-henderson in https://github.com/modelcontextprotocol/typescript-sdk/pull/1116
• [auth] Adjust scope management to line up with SEP-835 by @​pcarleton in https://github.com/modelcontextprotocol/typescript-sdk/pull/1133
• chore: add .idea/ to .gitignore by @​maxisbey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1134
• chore: remove unused @​types/eslint__js dependency by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1128
• feat: url based client metadata registration (SEP 991) by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1127
• feat: zod v4 with backwards compatibility for v3.25+ by @​dclark27 in https://github.com/modelcontextprotocol/typescript-sdk/pull/1040
• fix: remove pnpm lock and regenerate package-lock by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1138
• docs: update installation instructions for zod peer dependency by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1139
• Implement SEP-1577 - Sampling With Tools by @​ochafik in https://github.com/modelcontextprotocol/typescript-sdk/pull/1101
• Follow up: unify v3 and v4 zod types via describe matrix and a test helper by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1141
• chore: Add deprecated marker to old elicitInput overload by @​nbarbettini in https://github.com/modelcontextprotocol/typescript-sdk/pull/1142
• fix: Connect error in URL elicitation example by @​nbarbettini in https://github.com/modelcontextprotocol/typescript-sdk/pull/1136
• Support upscoping on insufficient_scope 403 by @​Nayana-Parameswarappa in https://github.com/modelcontextprotocol/typescript-sdk/pull/1115
• Support beta releases by publishing with --tag beta by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1146
• Bump version to 1.23.0-beta.0 by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1147
• SEP-1613: use.catchall() on inputSchema/outputSchema to support JSON Schema 2020-12 by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1135
• sampling: validate tools, tool_use, tool_result constraints by @​ochafik in https://github.com/modelcontextprotocol/typescript-sdk/pull/1156
• fix: React to upstream RC schema changes for form mode elicitation requests by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1164
• feat: implement SEP-1699 SSE polling via server-side disconnect by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1129
• chore: bump package number for release by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1170

New Contributors

• @​nbarbettini made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1105
• @​m-henderson made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1116
• @​maxisbey made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1134
• @​dclark27 made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1040
• @​Nayana-Parameswarappa made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1115

Full Changelog: modelcontextprotocol/typescript-sdk@1.22.0...1.23.0

v1.22.0

Compare Source

What's Changed

• registerTool: accept ZodType for input and output schema by @​ksinder in https://github.com/modelcontextprotocol/typescript-sdk/pull/816
• SEP-1319: Decouple Request Payloads, Remove passthrough iteration, Typecheck fixes by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1086
• add pkg-pr-new bot by @​pcarleton in https://github.com/modelcontextprotocol/typescript-sdk/pull/1088
• Upgrade to Node LTS by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1072
• change step name by @​pcarleton in https://github.com/modelcontextprotocol/typescript-sdk/pull/1089
• SEP-1034: Default values for Elicitation Schemas by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1096
• SEP-1330: Compatibility with SEP-1034 by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1100
• Implementation of SEP-986: Specify Format for Tool Names by @​kentcdodds in https://github.com/modelcontextprotocol/typescript-sdk/pull/900
• [auth] Fix march spec fallback for metadata discovery by @​pcarleton in https://github.com/modelcontextprotocol/typescript-sdk/pull/1108
• chore: bump version for release by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1110

New Contributors

• @​ksinder made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/816

Full Changelog: modelcontextprotocol/typescript-sdk@1.21.1...1.22.0

v1.21.2

Compare Source

What's changed

This is a patch release for a regression highlighted by #​1103

This patch contains only the cherry picked fix in #​1108

Full Changelog: modelcontextprotocol/typescript-sdk@1.21.1...1.21.2

v1.21.1

Compare Source

What's Changed

• Only use path-based discovery URLs from the authorization server to discover metadata by @​roadmapper in https://github.com/modelcontextprotocol/typescript-sdk/pull/1070
• Add @​deprecated annotations to legacy APIs by @​domdomegg in https://github.com/modelcontextprotocol/typescript-sdk/pull/1018
• fix: Support WWW-Authenticate scope param for SEP-835 by @​chipgpt in https://github.com/modelcontextprotocol/typescript-sdk/pull/983
• move CLI script to dedicated scripts directory by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1073
• Check script which typechecks using Typescripts new Go port by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1075
• FIX: use a nightly spec.types.ts by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1087
• chore: bump version for release by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1085

New Contributors

• @​roadmapper made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1070

Full Changelog: modelcontextprotocol/typescript-sdk@1.21.0...1.21.1

v1.21.0

Compare Source

What's Changed

• feat: pluggable JSON schema validator providers by @​mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/1012
• Update metadata.ts by @​pcarleton in https://github.com/modelcontextprotocol/typescript-sdk/pull/1010
• fix: Prefer the token_endpoint_auth_method response from DCR registration by @​chipgpt in https://github.com/modelcontextprotocol/typescript-sdk/pull/1022
• Fix: Non-existent tool, disabled tool and inputSchema validation return MCP protocol level instead of CallToolResult with isError: true by @​KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/1044
• chore: bump version to 1.21.0 for release by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1062

New Contributors

• @​chipgpt made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1022

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.2...1.21.0

v1.20.2

Compare Source

What's Changed

• fix: Zod to JSONSchema pipe strategies by @​pierreliefauche in https://github.com/modelcontextprotocol/typescript-sdk/pull/962
• chore: bump version for weekly release by @​felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1042

New Contributors

• @​pierreliefauche made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/962

Full Changelog: modelcontextprotocol/typescript-sdk@1.20.1...1.20.2

---

• If you want to rebase/retry this PR, check this box