Bump the all-dependencies group with 4 updates - #1465

Sourced from AngleSharp's releases.

1.9.1

Released on Sunday, November 1 2026.

What's Changed

• Improved performance of inserting a newly created node (AppendChild, InsertBefore, ...) into a deep tree (#​1401) @​michaelthyregod
• Fixed classList.toggle(token, false) adding an absent token instead of removing it: the DOM's toggle is now DomTokenListExtensions.ToggleToken
• Fixed exponential matching of nested :nth-child(… of …) selectors (#​1403) @​michaelthyregod
• Improved handling of deeply nested selector functions (#​1402) @​michaelthyregod
• Released 1.9.1 by @​FlorianRappl in Release 1.9.1 AngleSharp/AngleSharp#1404

Full Changelog: AngleSharp/AngleSharp@v1.9.0...v1.9.1

1.9.0

Released on Friday, October 30 2026.

What's Changed

• Improved performance of TextContent, :contains(), GetElementById, GetElementsByName, GetElementsByClassName, GetElementsByTagName and Normalize, which also continue with an explicit stack below 128 levels instead of recursing (#​1389) @​michaelthyregod
• Improved performance of IHtmlParser.ParseFragment and of inserting many nodes at once (Append, Prepend, ...): finding a template's host no longer scans the whole document, and removing a node's last child no longer scans its siblings
• Improved performance of removing or inserting a node's first child, which no longer shifts all its siblings, so moving every child of a large node one by one (or replacing it via innerHTML) takes linear time; each node with children also allocates one object less
• Improved quadratic parse time on hostile markup: elements and text foster-parented out of a table, a text run split by ignored end tags (x</q>x</q>...), and repeated html / body start tags piling up attributes; attribute name lookups on elements with many attributes no longer scan them
• Improved performance of :has(): relative arguments only walk what they can reach (:has(> a) the descendants, :has(+ a) / :has(~ a) the following siblings) instead of the parent's whole subtree, the walk no longer allocates, and a :has() is tested after the rest of its compound and its ancestor chain, so rules such as .tree :has(.skeleton):hover only walk subtrees of hovered elements inside .tree
• Fixed setInterval with a delay of 0 never yielding: every round completed synchronously and queued tasks until memory ran out; a negative delay of setTimeout or setInterval threw instead of counting as 0 (nested intervals now wait at least 4ms, as in browsers)
• Fixed fragment parsing (ParseFragment, innerHTML) to break out of svg / math on HTML start tags such as p, b or div, which previously stayed foreign elements
• Fixed CreateElement<TElement>() depending on reflection that trimming can break; IElement, IHtmlElement and ISvgElement now throw instead of returning an arbitrary element @​michaelthyregod
• Fixed IHtmlParser.ParseFragment to keep an SVG or MathML context element in its namespace (and an annotation-xml context's encoding), instead of parsing as if the context were an HTML element of the same name, and to find a form ancestor of the context, so a nested <form> start tag is ignored as with innerHTML
• Fixed inserting a detached template into its own contents not throwing a HierarchyRequestError
• Fixed AwaitEventAsync removing its listener off-thread while a dispatch was still running (#​1397) @​michaelthyregod
• Fixed event listener registration racing a dispatch on another thread @​michaelthyregod
• Fixed IHtmlSelectElement.SelectedIndex gaining a setter; set Options.SelectedIndex to change the selection (#​1395) @​SimonCropp
• Added AwaitEventAsync overload taking a CancellationToken @​michaelthyregod
• Added trimming and Native AOT compatibility (IsAotCompatible) for the .NET 8 and .NET 10 targets (#​1398) @​michaelthyregod
• Added trim-safe generic overloads of SubmitAsync, Attr, VirtualResponse.Headers and ToDictionary, which calls with an anonymous object bind to when recompiled; the Object overloads are now obsolete @​michaelthyregod
• Released 1.9.0 by @​FlorianRappl in Release 1.9.0 AngleSharp/AngleSharp#1399

New Contributors

• @​michaelthyregod made their first contribution in Fix stack overflow on deeply nested documents AngleSharp/AngleSharp#1389

Full Changelog: AngleSharp/AngleSharp@v1.8.6...v1.9.0

Commits viewable in compare view.

Sourced from DnsClientX's releases.

2.2.0

2.2.0 - 2026-11-02

The CLI archives cover Windows, Linux and macOS on x64 and ARM64. They are framework-dependent: choose the .NET 8 or .NET 10 archive matching your installed runtime. Windows CLI executables are signed.

• Publish the core NuGet package, PowerShell module and CLI archives without optional provider dependencies. DnsClientX.Odoh, DnsClientX.DnsCrypt and DnsClientX.DnsSec.EdDsa are not published on NuGet and are excluded from this release; their examples require source-built providers.

• Include the DNS correctness, configuration, DNSSEC, cache and cross-platform workflow fixes from #​581, authenticated DNS administration and discovery workflows from #​582, and stable resolver-candidate identity and reporting from #​583.

• Add a deterministic provider-by-transport JSON catalog at Assets/Data/provider-profiles.json, generated with the README from the library's supported formats and default configurations. Packaged-module validation checks both outputs against the library.

• Refresh dependencies and improve regression coverage across the supported .NET and PowerShell targets.

• Normalize recognized JSON EDE comments into structured extended DNS errors without replacing provider comments or explicit error arrays.

• Select published provider transports without changing existing preset defaults, with shared provider definitions for configuration, resolver expansion and generated documentation.

• Configure DNSCrypt and ODoH providers from role-specific DNS stamps, inspect privacy stamps from CLI/PowerShell, and load trusted optional providers explicitly for queries without adding crypto dependencies to the core or CLI.

• Add New-DnsPrivacyTransport for caller-owned PowerShell setup and CLI privacy query options using the shared response and explanation workflow.

• Preserve completed TCP/DoT replies when a peer closes while the request write finishes, avoiding a false failure and duplicate retry.

• Add data_normalized to record JSON while preserving the existing raw data field.

• Show provider diagnostics in regular CLI text output and include DNS status in PowerShell warnings through shared display-safe formatting.

• Give cooperative PowerShell query cleanup up to one second to finish when the pipeline is stopped, using the canonical async cmdlet implementation.

• Add CleanBrowsing Security, Adult, and Family DoH presets, and Control D Unfiltered, Malware, Ads & Tracking, and Family DoH presets.

• Add Comodo Secure DNS and DNS.WATCH plain-DNS presets, including DNS.WATCH's IPv6 resolvers.

• Refresh AdGuard presets to the current adguard-dns.com hostnames and share their endpoint definitions with multi-resolver queries.

• Document personal NextDNS profile URLs and distinguish generic resolution, filtering policy, and encrypted transports.

Commits viewable in compare view.

Sourced from Mailozaurr's releases.

3.0.6

What's Changed

• Bump the dotnet-platform group with 6 updates by @​dependabot[bot] in Bump the dotnet-platform group with 6 updates Mailozaurr#709
• Bump MailKit and MimeKit by @​dependabot[bot] in Bump MailKit and MimeKit Mailozaurr#710
• Add shared SMTP server failover and batch delivery sessions by @​PrzemyslawKlys in Add shared SMTP server failover and batch delivery sessions Mailozaurr#716

Full Changelog: EvotecIT/Mailozaurr@Mailozaurr-v3.0.5...Mailozaurr-v3.0.6

Commits viewable in compare view.

Sourced from ModelContextProtocol's releases.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. McpClient.ServerInfo is nullable — #​1903
   • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
   • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
   • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
   • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

• Correct protocol-version telemetry for stateless server spans #​1810 by @​luisangelrod
• Preserve HTTP errors and correct discovery fallback handling #​1791 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Make modern Streamable HTTP status mapping deterministic #​1837 by @​jstar0
  • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
• Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #​1852 by @​halter73 (co-authored by @​Copilot)
• Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #​1855 by @​scottt732
• Close server stdin before waiting for graceful stdio process exit #​1838 by @​luisangelrod
• Preserve insertion order when listing server tools, prompts, and resources #​1924 by @​PederHP (co-authored by Claude Opus 5.5)
• Allow missing optional server identity in discovery and make ServerInfo nullable #​1903 by @​Coding-Professional
• Include JSON parse details in Streamable HTTP 400 responses #​1844 by @​ump45nose
• Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #​1719 by @​halter73 (co-authored by @​Copilot)
  • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
  • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
• Preserve numeric progress tokens in RequestOptions serialization #​1832 by @​dfedoryshchev
• Dispose legacy SSE POST responses to release connections deterministically #​1841 by @​yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

• Document standing support for new MCP specification revisions #​1826 by @​halter73 (co-authored by @​Copilot)

Test Improvements

• Stabilize discovery-capable test connections while retaining initialization deadlines #​1943 by @​tarekgh

Repository Infrastructure Updates

• Add a source selector for manual documentation publishes #​1828 by @​jeffhandley (co-authored by @​Copilot)
• Update SourceLink's private build dependency to resolve a vulnerable Git dependency #​1873 by @​halter73 (co-authored by @​Copilot)
• Correct obsolete McpServerFactory references in Copilot instructions #​1892 by @​Zir0-93
• Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #​1940

Acknowledgements

• @​scottt732 made their first contribution in #​1855
• @​Zir0-93 made their first contribution in #​1892
• @​Coding-Professional made their first contribution in #​1903
  ... (truncated)

2.2.0

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

• Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #​1796 by @​saicharanpardhu (co-authored by @​Copilot @​jeffhandley)
• Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #​1805 by @​latent-9

Test Improvements

• Fix duplicated word in test comment #​1809 by @​latent-9

Repository Infrastructure Updates

• Enable package validation for the MCP extension packages #​1793 by @​jeffhandley (co-authored by @​Copilot)
• Add a release-manager agent that orchestrates the release skills #​1794 by @​jeffhandley (co-authored by @​Copilot)
• Bump Anthropic from 12.39.0 to 12.40.0 #​1808
• Bump @​hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #​1812
• Fix dead relative link to versioning docs in bump-version skill #​1807 by @​latent-9

Acknowledgements

• @​latent-9 made their first contribution in #​1807
• @​saicharanpardhu made their first contribution in #​1796
• @​saicharanpardhu submitted issue #​1777 (resolved by #​1796)
• @​jeffhandley @​tarekgh @​halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

2.1.0

This release adds an opt-in subscriptions/listen handler for custom server-side notification streams, improves HTTP transport fallback reliability, and expands guidance and samples for telemetry and binary resources.

What's Changed

• Keep AutoDetect channel open after provisional SSE failure #​1768 by @​PranavSenthilnathan
• Preserve HTTP status codes across target frameworks #​1767 by @​PranavSenthilnathan
• Fall back to initialize when server/discover fails at the HTTP layer #​1766 by @​rbstp
• Add public subscriptions/listen server handler (SEP-2575) #​1775 by @​tarekgh

Documentation Updates

• Add README for the InMemoryTransport sample #​1769 by @​AkbarDizaji
• Add Application Insights telemetry example #​1778 by @​lntutor
• Clarify client handling of embedded binary tool resources #​1762 by @​luisangelrod

Test Improvements

• Speed up CLI argument escaping tests #​1773 by @​PranavSenthilnathan

Repository Infrastructure Updates

• Clarify AI disclosure format with a > [!NOTE] alert example #​1771 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Bump the npm_and_yarn group across 1 directory with 6 updates #​1787
• Avoid reading Configuration in Directory.Build.props #​1776 by @​lntutor
• Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 #​1784

Acknowledgements

• @​AkbarDizaji made their first contribution in #​1769
• @​luisangelrod made their first contribution in #​1762
• @​rbstp submitted issue #​1765 (resolved by #​1766)
• @​TomasHubelbauer submitted issue #​1026 (resolved by #​1778)
• @​Youssef1313 submitted issue #​995 (resolved by #​1766)
• @​eng-marani submitted issue #​1261 (resolved by #​1762)
• @​jeffhandley @​tarekgh @​halter73 @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0...v2.1.0

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

1. Default to stateless HTTP and discovery-first negotiation #​1610
   • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
   • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
   • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
2. Deprecate Roots, Sampling, and Logging APIs #​1651
   • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
   • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
3. Move Tasks into ModelContextProtocol.Extensions.Tasks #​1693
   • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
   • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
4. Strengthen OAuth callback and issuer validation #​1605
   • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
   • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
5. Emit non-object structured tool results directly #​1568
   • Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
   • Update clients to read the value according to the advertised output schema rather than assuming a result property.
6. Require Tool.inputSchema during deserialization #​1600
   • Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
   • Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
7. Require explicit PKCE S256 support in OAuth metadata #​1700
   • OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
   • Update the authorization server metadata to declare PKCE S256 support.
8. Send application_type during dynamic client registration #​1613
   • Dynamic client registration requests now include an inferred application_type.
   • Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
9. Propagate underlying SSE connection exceptions #​1432
   • Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
   • Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
10. Fail OAuth step-up when a challenge makes no progress #​1591
    • A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
    • Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

• Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73
• Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
• Implement SEP-2243 HTTP header standardization #​1553 by @​mikekistler (co-authored by @​tarekgh @​Copilot)
• Append offline_access to authorization scope when advertised (SEP-2207) #​1479 by @​stephentoub (co-authored by @​Copilot)
• Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #​1558 by @​jayaraman-venkatesan
• Add APIs for pre-populating the McpClient tool cache #​1590 by @​tarekgh
• Add ScopeSelectorDelegate to OAuth options #​1596 by @​halllo
• Validate the authenticated user on Streamable HTTP session deletion #​1604 by @​halter73
  ... (truncated)

2.0.0-rc.2

This second 2.0 release candidate advances the SDK’s 2026-07-28 protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.

Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

1. Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #​1752
   • Aligns with protocol adjustment #​3002.
   • DiscoverResult.ServerInfo is removed; read and deserialize Meta[MetaKeys.ServerInfo] instead.
   • On 2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods with server/discover, _meta log level, and subscriptions/listen.
2. Validate OAuth authorization state #​1726
   • Custom authorization callback handlers must propagate the redirect state through AuthorizationResult.State, and should return Code, State, and Iss.
3. Fix SSE session transport shutdown behavior #​1432
   • Handle the underlying transport exception rather than depending on an IOException wrapper.

What's Changed

• Fix SSE session transport shutdown behavior #​1432 by @​xue-cai (co-authored by @​Copilot)
• Validate OAuth authorization state #​1726 by @​halter73 (co-authored by @​Copilot)
• Add configurable Tasks execution modes and complete conformance support #​1741 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Gate 2026-07-28 result fields by negotiated protocol version #​1753 by @​tarekgh
• Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #​1752 by @​pcarleton (co-authored by @​tarekgh @​Copilot)
• Reauthorize tools changed by call-tool filters #​1737 by @​PranavSenthilnathan (co-authored by @​Copilot)

Documentation Updates

• Refine 2.0.0 concept documentation #​1742 by @​jeffhandley (co-authored by @​Copilot)

Test Improvements

• Resolve test-server paths deterministically #​1735 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Add MCP Apps NativeAOT coverage #​1711 by @​lntutor
• Add MCP Apps _meta.ui serialization round-trip tests #​1698 by @​yayayouyou

Repository Infrastructure Updates

• Bump actions/setup-node from 6.4.0 to 7.0.0 #​1717
• Bump coverlet.collector from 10.0.0 to 10.0.1 #​1582
• Bump qs from 6.14.2 to 6.15.2 #​1597
• Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #​1716
• Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #​1569
• Bump actions/checkout from 6 to 7 #​1665
• Rename MCPEXP002 extensibility constants #​1739 by @​arimu1
• Bump the testing-frameworks group #​1746
• Bump the serilog-testing group #​1748
• Bump actions/checkout from 7.0.0 to 7.0.1 #​1745
• Bump Anthropic from 12.17.0 to 12.39.0 #​1750
• Bump OpenTelemetry and five other dependencies #​1747
  ... (truncated)

2.0.0-rc.1

2.0.0-rc.1 advances the v2 SDK toward general availability with stronger OAuth conformance, improved dynamic client registration, and expanded Tasks validation.

We remain on-track to release 2.0.0 stable on or before 2026-07-28.

We want to give a big thanks to @​KubaZ2 for reporting the critical, ship-stopping Tasks/HTTP defect in #​1720, fixed by #​1722!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Remove the preview task-scope helper #​1722

   • McpTasksServerExtensions.CreateMcpTaskScope(...) was removed from the stable surface. This affects only applications built against the v2 preview API; no stable 2.0 release has shipped.
   • There is no stable direct replacement; update affected task-scope integration code for the current Tasks APIs.

2. Harden OAuth issuer validation #​1605

   • AuthorizationRedirectDelegate now produces MCP9007, which breaks warning-as-error builds; the manual authorization flow now requires the complete redirect URL.
   • Migrate to AuthorizationCallbackHandler and return AuthorizationResult.

3. Require advertised PKCE S256 support #​1700

   • Authorization servers that omit code_challenge_methods_supported: ["S256"] now cause authentication to fail instead of receiving an inferred default.
   • Correct the authorization-server metadata or use a compliant discovery document.

4. Send Dynamic Client Registration application types #​1613

   • Unset ApplicationType now sends an inferred application_type instead of omitting it.
   • Set DynamicClientRegistrationOptions.ApplicationType explicitly when the authorization server requires another value.

What's Changed

• Require advertised PKCE S256 support #​1700 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Make authorization-provider token caches thread-safe #​1708 by @​tarekgh
• Send application_type in Dynamic Client Registration requests #​1613 by @​jayaraman-venkatesan (co-authored by @​Copilot)
• Preserve the original AutoDetect probe status code #​1530 by @​MukundaKatta
• Return JSON-RPC parse errors for over-nested stdio requests #​1629 by @​adityasingh2400
• Implement RFC 9207 issuer validation in ClientOAuthProvider #​1605 by @​mikekistler (co-authored by @​halter73 @​Copilot)
• Reject mismatched initialize protocol versions #​1724 by @​halter73 (co-authored by @​Copilot)
• Fix OAuth client-ID initialization on cold start #​1705 by @​halter73 (co-authored by @​Copilot)
• Fix HTTP task-filter composition #​1722 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Add initial Tasks extension conformance coverage #​1734 by @​PranavSenthilnathan (co-authored by @​Copilot)

Documentation Updates

• Publish a side-by-side, multi-version documentation site with selectable release/1.x (v1.4.1) and main (v2 preview) content #​1727 by @​jeffhandley (co-authored by @​Copilot)
• Add Docker-based MCP server deployment guidance #​1423 by @​john-mckillip (co-authored by @​Copilot)
• Improve v2 conceptual documentation clarity and consistency #​1728 by @​gewarren
• Improve v1 documentation clarity and consistency, and versioning updates #​1729 by @​jeffhandley (co-authored by @​Copilot)

Test Improvements

• Expand npm conformance coverage #​1725 by @​halter73 (co-authored by @​Copilot)
• Extend the in-memory server/discover probe timeout to prevent flaky Windows Debug CI hangs #​1702 by @​PranavSenthilnathan (co-authored by @​halter73 @​Copilot)
  ... (truncated)

2.0.0-preview.3

This preview reorganizes the Tasks feature into its own ModelContextProtocol.Extensions.Tasks package, keeping ModelContextProtocol.Core focused on the base protocol while a new generic request-handler and alternate-result surface lets the Tasks package layer on top. It also delivers correctness fixes to the draft 2026-07-28 protocol -- per-request client capabilities, negotiation boundaries, and the resultType discriminator -- plus Streamable HTTP client improvements (an empty-JSON-response fix and a new standalone GET-stream opt-out) and conformance-test consolidation.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Tasks extracted into the new ModelContextProtocol.Extensions.Tasks package #​1693
   • The Tasks API -- task result/notification types, McpTaskStatus, IMcpTaskStore/InMemoryMcpTaskStore, the tasks/* request methods, and the client GetTaskAsync/UpdateTaskAsync/CancelTaskAsync/CallToolRawAsync methods -- is removed from ModelContextProtocol.Core and relocated to the new ModelContextProtocol.Extensions.Tasks package under the ModelContextProtocol.Extensions.Tasks namespace.
   • Core now exposes a task-agnostic ResultOrAlternate<T> (replacing ResultOrCreatedTask<T>) plus generic extension points -- McpServerRequestHandler, McpServerOptions.RequestHandlers, McpServerHandlers.CallToolWithAlternateHandler, McpRequestFilters.CallToolWithAlternateFilters, and McpServer.InterceptOutgoingRequests -- that the Tasks package builds on.
   • Migration: add a PackageReference to ModelContextProtocol.Extensions.Tasks; change using ModelContextProtocol.Protocol; to using ModelContextProtocol.Extensions.Tasks; for task types; the task client/server APIs are now extension methods (McpTasksClientExtensions/McpTasksServerExtensions), and the task store is registered via the new builder extensions instead of McpServerOptions.TaskStore.

Experimental APIs

To support extracting Tasks (#​1693), ModelContextProtocol.Core gained a generic server-extension surface -- ResultOrAlternate<T>, McpServerRequestHandler, McpServerOptions.RequestHandlers, McpServerHandlers.CallToolWithAlternateHandler, McpRequestFilters.CallToolWithAlternateFilters, and McpServer.InterceptOutgoingRequests -- that lets extension packages such as ModelContextProtocol.Extensions.Tasks layer behavior onto the server pipeline. These APIs are annotated [Experimental] under diagnostic ID MCPEXP002.

This surface is still being designed: #​1704 tracks composing these seams with the normal filter and subscription pipeline (typed custom RPCs, filter composition, and extension-defined subscriptions). Expect these low-level extensibility APIs to change and potentially remain [Experimental] through the 2.0.0 stable release.

What's Changed

• Fix request-scoped draft client capabilities #​1685 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Tighten draft protocol negotiation boundaries #​1692 by @​halter73 (co-authored by @​Copilot)
• Fix missing resultType on complete result responses #​1684 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Ignore empty Streamable HTTP JSON responses #​1626 by @​jstar0
• Extract Tasks into the ModelContextProtocol.Extensions.Tasks extension package #​1693 by @​jeffhandley (co-authored by @​Copilot)
• Add opt-out for Streamable HTTP standalone GET stream #​1699 by @​jstar0 (co-authored by @​Copilot)

Test Improvements

• Re-enable http-custom-headers conformance scenario #​1691 by @​tarekgh
• Run stateful and stateless conformance endpoints in a single server process #​1672 by @​halter73 (co-authored by @​Copilot)

Acknowledgements

• @​jstar0 made their first contribution in #​1626
• @​cclabadmin submitted #​1676 (resolved by #​1684)
• @​cclabadmin submitted #​1680 (resolved by #​1692)
• @​DmitryLukyanov submitted #​1132 (resolved by #​1626)
• @​KirillOsenkov submitted #​1637 (resolved by #​1699)
• @​halter73 @​tarekgh @​PranavSenthilnathan @​jeffhandley reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.2...v2.0.0-preview.3

2.0.0-preview.2

This second preview of the 2.0.0 series advances the SDK's alignment with the upcoming 2026-07-28 MCP protocol revision: it adds client-side conformance diagnostics for the SEP-2549 caching hints, makes Streamable HTTP error responses echo the request id per the base protocol and SEP-2243, and fully stabilizes now-stable protocol properties so consumer-defined source generators serialize them correctly. Separately -- and unrelated to the protocol revision -- it introduces DeferChangedEvents() on McpServerPrimitiveCollection<T> for batching list_changed notifications when registering primitives in bulk. There are no breaking changes relative to v2.0.0-preview.1.

What's Changed

• Document caching behavior and warn on non-conformant draft cacheable results (SEP-2549 follow-up) #​1669 by @​tarekgh
• Fully stabilize now-stable protocol properties #​1686 by @​eiriktsarpalis (co-authored by @​Copilot)
• Echo request id in post-parse Streamable HTTP error responses #​1687 by @​tarekgh
• Add DeferChangedEvents() to McpServerPrimitiveCollection for batched change notifications #​1689 by @​jeffhandley (co-authored by @​Copilot)

Documentation Updates

• Update package READMEs as part of the release process #​1683 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

• @​cclabadmin submitted issue #​1677 (resolved by #​1687)
• @​lewing submitted issue #​1688 (resolved by #​1689)
• @​PranavSenthilnathan @​halter73 @​davidortinau @​jeffhandley @​lewing @​tarekgh reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0-preview.1...v2.0.0-preview.2

2.0.0-preview.1

This is the first preview of the C# MCP SDK 2.0.0, designed for alignment with the 2026-07-28 MCP specification release. The SDK implements the 2026-07-28 protocol version which fundamentally changes how clients and servers interact -- removing the initialize handshake (SEP-2575), eliminating server-side session state (SEP-2567), introducing Multi Round-Trip Requests (SEP-2322), and deprecating legacy capabilities in favor of the new extensions framework (SEP-2133).

The 2.0.0 SDK is fully backward-compatible with servers and clients using the previous 2024-11-05 protocol version. Clients automatically negotiate down to the legacy initialize handshake when connecting to older servers, and servers continue to accept initialize requests from older clients. API breaking changes in 2.0.0 are limited to two categories: (1) APIs for capabilities deprecated by the new specification (Roots, Sampling, and Logging), which are now marked [Obsolete] with guidance toward their replacements, and (2) experimental APIs whose contracts changed as the specifications were finalized. Stable, non-deprecated APIs from 1.x continue to work without modification.

Protocol Version Negotiation and Handshake Behavior

The 2.0.0 SDK introduces a fundamentally new connection lifecycle:

Default behavior (no configuration needed):

1. Client sends a server/discover request with MCP-Protocol-Version: 2026-07-28
2. If the server supports the 2026-07-28 protocol version, it responds with capabilities -- no handshake, no session
3. If the server returns an error (MethodNotFound, InvalidParams, etc.) or times out (5s default via McpClientOptions.DiscoverProbeTimeout), the client automatically falls back to the legacy initialize handshake with 2025-11-25
4. Three "modern server" error codes (-32022 UnsupportedProtocolVersion, -32021 MissingRequiredClientCapability, -32020 HeaderMismatch) are never treated as legacy indicators and are surfaced as errors

Opting out of the 2026-07-28 protocol version:

• Set McpClientOptions.ProtocolVersion = "2025-11-25" to force the legacy initialize handshake and disable the automatic fallback (a non-null ProtocolVersion now acts as both the requested version and the minimum the client accepts)

Per-request metadata (2026-07-28 protocol version):

• Every request carries _meta with io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientInfo, and io.modelcontextprotocol/clientCapabilities
• Servers MUST NOT infer capabilities from previous requests -- each request is self-describing

2026-07-28 Spec Alignment: SEP Implementation Status

The 2026-07-28 specification release includes 22 SEPs. The table below summarizes C# SDK status. Remaining work is tracked in the 2026-07-28 Spec Compliance milestone.

1.4.2

This patch release includes security fixes for OAuth authentication and authenticated HTTP sessions.

What's Changed

• Validate OAuth PKCE support and metadata issuer #​1949 by @​halter73 (co-authored by @​PranavSenthilnathan @​Copilot)

Deployments using metadata-free 2025-03-26 OAuth discovery may explicitly enable the legacy endpoint fallback only after independently verifying PKCE enforcement; otherwise, update metadata to advertise S256. The process-wide opt-in is ModelContextProtocol.Authentication.AllowLegacyOAuthMetadataFallback; it does not bypass validation of discovered metadata.

• Harden authenticated HTTP session handling (7c5d15e) by @​halter73 (co-authored by @​jeffhandley @​PranavSenthilnathan @​Copilot)

Documentation Updates

• Sanitize 1.x documentation #​1729 by @​jeffhandley
• Document standing support for new MCP revisions #​1827 by @​jeffhandley (co-authored by @​halter73 @​Copilot)

Repository Infrastructure Updates

• Update SourceLink for 1.x documentation builds #​1944 by @​jeffhandley (co-authored by @​Copilot)
• Enable CodeQL for release branches #​1947 by @​halter73 (co-authored by @​Copilot)
• Add versioned docs publishing infrastructure #​1980 by @​jeffhandley (co-authored by @​Copilot)
• Fix Markdown link-check warnings and outdated Skills specification link #​1978 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

• @​halter73 @​jeffhandley @​PranavSenthilnathan @​tarekgh reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.1...v1.4.2

[!NOTE]
These release notes were drafted with GitHub Copilot.

Commits viewable in compare view.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions