Bump the all-dependencies group with 2 updates

[dependabot]

Updated Microsoft.NET.Test.Sdk from 18.0.1 to 18.3.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.3.0

What's Changed

• Fix answer file splitting by @​nohwnd in Fix answer file splitting microsoft/vstest#15306

Internal fixes and updates

• Bump branding to 18.1 by @​nohwnd in Bump branding to 18.1 microsoft/vstest#15286
• Remove stale copy of S.ComponentModel.Composition from testplatform packages by @​ViktorHofer in Remove stale copy of S.ComponentModel.Composition from testplatform packages microsoft/vstest#15287
• Update codeflow metadata to fix backflow by @​premun in Update codeflow metadata to fix backflow microsoft/vstest#15291
• [main] Update dependencies from devdiv/DevDiv/vs-code-coverage by @​dotnet-maestro[bot] in [main] Update dependencies from devdiv/DevDiv/vs-code-coverage microsoft/vstest#15283
• Update Microsoft.Build.Utilities.Core by @​Youssef1313 in Update Microsoft.Build.Utilities.Core microsoft/vstest#15300
• Disable DynamicNative instrumentation by default by @​nohwnd in Disable DynamicNative instrumentation by default microsoft/vstest#15299
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15293
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15302
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15314
• Delete sha1 custom implementation we are not using for a long time by @​nohwnd in Delete sha1 custom implementation we are not using for a long time microsoft/vstest#15313
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15315
• Update branding to 18.3.0 by @​nohwnd in Update branding to 18.3.0 microsoft/vstest#15321
• [main] Update dependencies from devdiv/DevDiv/vs-code-coverage by @​dotnet-maestro[bot] in [main] Update dependencies from devdiv/DevDiv/vs-code-coverage microsoft/vstest#15325
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [main] Update dependencies from dotnet/arcade microsoft/vstest#15264
• Revert adding dotnet_host_path workaround by @​nohwnd in Revert adding dotnet_host_path workaround microsoft/vstest#15328
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [main] Update dependencies from dotnet/arcade microsoft/vstest#15338
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in [main] Source code updates from dotnet/dotnet microsoft/vstest#15322
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [main] Update dependencies from dotnet/arcade microsoft/vstest#15343
• Change PreReleaseVersionLabel from 'preview' to 'release' by @​nohwnd in Change PreReleaseVersionLabel from 'preview' to 'release' microsoft/vstest#15352
• [rel/18.3] Update dependencies from devdiv/DevDiv/vs-code-coverage by @​dotnet-maestro[bot] in [rel/18.3] Update dependencies from devdiv/DevDiv/vs-code-coverage microsoft/vstest#15354
• [rel/18.3] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [rel/18.3] Update dependencies from dotnet/arcade microsoft/vstest#15389
• [rel/18.3] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [rel/18.3] Update dependencies from dotnet/arcade microsoft/vstest#15400
• Update build tools to 17.11.48 to be source buildable by @​nohwnd in Update build tools to 17.11.48 to be source buildable microsoft/vstest#15310
• Disable publishing on RTM by @​nohwnd in Disable publishing on RTM microsoft/vstest#15296
• Don't access nuget.org for package feeds by @​nohwnd in Don't access nuget.org for package feeds microsoft/vstest#15316
• No nuget access fix tests by @​nohwnd in No nuget access fix tests microsoft/vstest#15317
• Disable Dependabot updates in dependabot.yml by @​mmitche in Disable Dependabot updates in dependabot.yml microsoft/vstest#15324

New Contributors

• @​premun made their first contribution in Update codeflow metadata to fix backflow microsoft/vstest#15291

Commits viewable in compare view.

Updated ModelContextProtocol from 0.8.0-preview.1 to 1.0.0.

Release notes

Sourced from ModelContextProtocol's releases.

1.0.0

This is the first stable release of the ModelContextProtocol C# SDK. Thank you to all of the contributors who helped us achieve this milestone!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Mark RunSessionHandler experimental (MCPEXP002) #​1383
   • HttpServerTransportOptions.RunSessionHandler is now annotated with [Experimental("MCPEXP002")]
   • Code that references RunSessionHandler will produce a compile-time warning (or error with TreatWarningsAsErrors); suppress with #pragma warning disable MCPEXP002
   • Consider using ConfigureSessionOptions as an alternative; RunSessionHandler may be removed or change signatures in a future release

What's Changed

• Add 2025-03-26 OAuth backward compatibility for client conformance #​1374 by @​jeffhandley (co-authored by @​Copilot)
• Mark RunSessionHandler experimental (MCPEXP002) #​1383 by @​halter73 (co-authored by @​Copilot @​jeffhandley)

Documentation Updates

• Fix a few bugs in the docs #​1379 by @​stephentoub
• Add and augment conceptual docs #​1375 by @​jeffhandley (co-authored by @​Copilot @​mikekistler @​stephentoub @​halter73)

Repository Infrastructure Updates

• Bump to version 1.0.0 (stable) #​1384 by @​jeffhandley

Acknowledgements

• @​halter73 @​stephentoub @​mikekistler @​eiriktsarpalis reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v1.0.0-rc.1...v1.0.0

1.0.0-rc.1

This release candidate completes a full API surface area audit ahead of the 1.0.0 stable release, with more changes to public APIs to ensure consistency and long-term maintainability. Protocol DTO types are updated to match the MCP specification, deprecated filter APIs are removed, and bug fixes improve transport reliability and JSON handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Address asymmetry in McpServerHandlers/McpClientHandlers and make all filter properties settable #​1337

   • Seals McpClientHandlers to match the already-sealed McpServerHandlers
   • Makes McpServerOptions.Handlers, McpServerOptions.Filters, and all IList<T> filter properties settable with null validation

2. Remove server back-references from protocol DTO types #​1345

   • Removes Tool.McpServerTool, Prompt.McpServerPrompt, Resource.McpServerResource, and ResourceTemplate.McpServerResource properties
   • Use McpServerPrimitiveCollection.TryGetPrimitive() for name-based lookups instead

3. Make Tool.Name required to match other protocol types #​1351

   • Adds required modifier to Tool.Name, matching Prompt.Name, Resource.Name, and other IBaseMetadata implementations
   • Callers must now specify Name in object initializers

4. Make LoggingMessageNotificationParams.Data required per MCP spec #​1353

   • Changes LoggingMessageNotificationParams.Data from JsonElement? to required JsonElement per the MCP specification

5. Fix CreateMessageRequestParams.Metadata type to JsonObject #​1354

   • Changes CreateMessageRequestParams.Metadata from JsonElement? to JsonObject? to match all other _meta/Meta properties in the SDK

6. Normalize CallToolResult.StructuredContent to JsonElement? #​1357

   • Changes CallToolResult.StructuredContent from JsonNode? to JsonElement? for consistency with the rest of the SDK
   • Use JsonSerializer.SerializeToElement() to produce a JsonElement

7. Unify service configuration for ISseEventStreamStore, IMcpTaskStore, and ISessionMigrationHandler #​1362

   • Consistent options + DI pattern: explicit options property > DI resolution

8. Add explicit [Experimental] protected constructors to McpClient and McpServer #​1363

   • Protected constructors on McpClient and McpServer now require suppressing MCPEXP002 to subclass

9. Remove MCP9002 obsolete APIs and document obsolete diagnostics #​1366

   • Removes the 13 AddXxxFilter extension methods on IMcpServerBuilder (e.g. AddCallToolFilter, AddListToolsFilter) that were deprecated under diagnostic MCP9002
   • Use WithRequestFilters() and WithMessageFilters() instead

10. Fix McpClientPrompt/Resource types to use RequestOptions like McpClientTool does #​1370

    • Replaces JsonSerializerOptions with RequestOptions parameter for consistency across McpClientPrompt, McpClientResource, and McpClientTool

What's Changed

• Make Tool.Name required to match other protocol types #​1351 by @​stephentoub (co-authored by @​Copilot)
• Make LoggingMessageNotificationParams.Data required per MCP spec #​1353 by @​stephentoub (co-authored by @​Copilot)
• Fix off-by-one error in reconnection attempts #​1356 by @​stephentoub (co-authored by @​Copilot)
• Remove server back-references from protocol DTO types #​1345 by @​stephentoub (co-authored by @​Copilot)
• Fix base64 deserialization when JSON encoder escapes forward slashes #​1342 by @​stephentoub (co-authored by @​Copilot)
• Increase MaxReconnectionAttempts default from 2 to 5 #​1355 by @​stephentoub (co-authored by @​Copilot)
• Prevent cancellation of initialize request per MCP spec #​1350 by @​stephentoub (co-authored by @​Copilot)
  ... (truncated)

0.9.0-preview.2

This release focuses on API surface consistency and correctness ahead of 1.0.0. Public collection properties are now typed as IList<T> instead of concrete List<T> or T[], and Root.Meta is aligned with the rest of the protocol DTOs by using JsonObject?. Other improvements include new experimental Extensions support for capabilities, missing ResourceLinkBlock properties, improved mimeType handling, and several documentation and test reliability fixes.

We plan to release the stable 1.0.0 release early in the week of February 23, 2026.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Replace concrete collection types with interfaces in public API surface #​1326

   • List<T> and T[] properties on ProtectedResourceMetadata, ToolResultContentBlock, ListTasksResult, and DynamicClientRegistrationResponse changed to IList<T>. Replace .Length with .Count and cast to List<T> if List<T>-specific members are needed.

2. Fix Root.Meta to use JsonObject instead of JsonElement #​1341

   • Root.Meta changed from JsonElement? to JsonObject?. Replace meta.Value.GetProperty("key").GetString() with (string?)meta["key"].

3. Make UrlElicitationRequiredErrorData.Elicitations consistent with other Protocol DTOs #​1335

   • Elicitations changed from IReadOnlyList<ElicitRequestParams> with init to IList<ElicitRequestParams> with set. Code using List<T> is unaffected since it implements both interfaces.

What's Changed

• Remove dead code: options ??= new() in McpServerImpl constructor #​1322 by @​stephentoub (co-authored by @​Copilot)
• Remove unnecessary _connectCts field from McpClientImpl #​1323 by @​stephentoub (co-authored by @​Copilot)
• Add missing Title and Icons properties to ResourceLinkBlock #​1320 by @​stephentoub (co-authored by @​Copilot)
• Omit null mimeType from ResourceContents JSON serialization #​1325 by @​stephentoub (co-authored by @​Copilot)
• Validate mimeType in ImageContentBlock.FromBytes and AudioContentBlock.FromBytes #​1321 by @​stephentoub (co-authored by @​Copilot)
• Replace concrete collection types with interfaces in public API surface #​1326 by @​stephentoub (co-authored by @​Copilot)
• Make UrlElicitationRequiredErrorData.Elicitations consistent with other Protocol DTOs #​1335 by @​stephentoub (co-authored by @​Copilot)
• Fix Metadata delegation in DelegatingMcpServerTool/Prompt/Resource #​1338 by @​stephentoub (co-authored by @​Copilot @​jeffhandley)
• Add Extensions support to ClientCapabilities and ServerCapabilities #​1317 by @​stephentoub (co-authored by @​Copilot)
• Fix _meta properties to use JsonObject #​1341 by @​stephentoub (co-authored by @​Copilot)

Documentation Updates

• Fix incorrect XML doc comments in McpClient.Methods.cs #​1333 by @​stephentoub (co-authored by @​Copilot)
• Add missing exception documentation for public APIs #​1339 by @​stephentoub (co-authored by @​Copilot)

Test Improvements

• Fix flaky DiagnosticTests on net10.0 by waiting for specific activities #​1324 by @​stephentoub (co-authored by @​Copilot)
• Fix flaky sse-retry conformance test due to CI timing overhead #​1336 by @​ericstj (co-authored by @​Copilot)

Repository Infrastructure Updates

• Bump version to 1.0.0-rc.1 #​1327 by @​jeffhandley (co-authored by @​Copilot)
• Add release-notes, breaking-changes, and bump-version Copilot skills #​1328 by @​jeffhandley (co-authored by @​Copilot)
• Bump hono from 4.11.7 to 4.12.0 in the npm_and_yarn group across 1 directory #​1316
• Bump version down to 0.9.0-preview.2 since we are still changing APIs #​1344 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

• @​halter73 @​eiriktsarpalis @​mikekistler reviewed pull requests
  ... (truncated)

0.9.0-preview.1

The 0.9.0-preview.1 release includes multiple breaking changes focused on quality, extensibility, usability, and API consistency as we continue refining the SDK in preparation for a stable 1.0.0 release.

We plan to release the stable 1.0.0 release early in the week of February 23, 2026.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Use ReadOnlyMemory<byte> for binary data to eliminate UTF-16 transcoding #​1070

   • ImageContentBlock.Data, AudioContentBlock.Data, and BlobResourceContents.Blob changed from string to ReadOnlyMemory<byte>; FromImage/FromAudio renamed to FromBytes; BlobResourceContents.Data renamed to DecodedData
   • Migration: Use DecodedData for decoded bytes and FromBytes(...) factory methods

2. Split configuration of request and message filters #​1308

   • Add*Filter extension methods on IMcpServerBuilder replaced by WithMessageFilters and WithRequestFilters callbacks with grouped builder instances
   • Migration: Wrap existing filter registration inside the new callback methods

3. Don't treat McpServerHandlers as an independent options type #​1313

   • McpServerHandlers no longer resolved via IOptions<McpServerHandlers>; handlers set directly on McpServerOptions.Handlers
   • Migration: Configure handlers through McpServerOptions directly

4. Add ISessionMigrationHandler #​1270

   • Stateful Streamable HTTP POST requests without a session ID are now rejected with 400 unless the message is an initialize request
   • Compat switch: ModelContextProtocol.AspNetCore.AllowNewSessionForNonInitializeRequests = true restores previous behavior

5. Change ProtectedResourceMetadata URI properties to strings #​1264

   • Multiple properties changed from Uri?/List<Uri> to string?/List<string> to avoid unwanted URI normalization
   • Migration: Use string values directly instead of Uri objects

6. Hide experimental types from external source generators using internal property pattern #​1301

   • Experimental properties now use [JsonIgnore] + internal delegate pattern; external source generators no longer reference experimental types
   • No code changes needed for most consumers

7. Validate MCP-Protocol-Version header in Streamable HTTP handler #​1277

   • Server returns HTTP 400 for invalid/unsupported header values; missing header still allowed
   • Migration: Ensure clients send a valid protocol version or omit the header

8. Update McpErrorCode and fix error code usage to align with MCP spec #​1291

   • Task support validation errors changed from MethodNotFound to InvalidParams
   • Migration: Update error code checks for task support validation scenarios

What's Changed

• Bring up to 0.1.13 conformance #​1254 by @​stephentoub
• Change ProtectedResourceMetadata URI properties to strings and build resource strings directly #​1264 by @​halter73 (co-authored by @​Copilot)
• Log tool call name on success, not just failure #​1256 by @​halter73 (co-authored by @​Copilot)
• Fix HttpClient timeout for long-running tools without event stream store #​1268 by @​halter73 (co-authored by @​Copilot)
• Fix stderr event loss due to missing WaitForExit in DisposeProcess #​1280 by @​stephentoub (co-authored by @​Copilot)
• Update McpErrorCode XML docs and fix error code usage to align with MCP spec #​1291 by @​stephentoub (co-authored by @​Copilot)
• Add X-Accel-Buffering header to SSE responses #​1294 by @​stephentoub (co-authored by @​Copilot)
• Fix StdioServerTransport.DisposeAsync() hang: CancellableStdinStream missing Dispose override #​1276 by @​stephentoub (co-authored by @​Copilot)
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions