Repository Issue Activity (beta)

#2036 Bump hono and fast-uri to versions covering published GHSA advisories

#2769 [v2] Streamable HTTP client does not clear stale resumption token after an empty SSE id

#2742 experimental.tasks.getTaskResult() throws TypeError: Cannot read properties of undefined (reading '_zod') when the optional result schema is omitted

#2766 Doc comments misattribute the token-endpoint TLS check to SEP-2207 (which is OIDC refresh / `offline_access`)

#2721 outputSchema always emitted as JSON Schema draft-07, breaking clients that only accept 2020-12

#2695 `maxTotalTimeout` is never enforced unless a progress notification arrives

#2739 StreamableHTTPClientTransport leaves POST requests pending when their SSE response ends or errors

#2037 DEFAULT_INHERITED_ENV_VARS

#2607 createMcpHandler: reused McpServer instance grows an unbounded onclose chain — memory leak, then uncatchable RangeError after ~20k requests

#2764 https://github.com/0xsarawut-eth/alch_TpT9E5IfjrDKMLGSbKF40/blob/main/SDK_INTEGRATION.md

#2723 remove() is a no-op after a handle is renamed, and the entry stays callable

#2084 [SEP-1613 regression] tools/list still emits draft-07 in 1.29.0 — `target` option missing from mcp.js `toJsonSchemaCompat` calls

#2760 [v2] Codemod treats SDK paths in string literals as imports

#2737 Upgrade `zod` dependency to `4.5.x`

#2598 v2: extension methods shadowed by legacy spec-method registry — custom tasks/get & tasks/cancel handlers unreachable (-32601 before handler lookup)

#1760 Race condition in auth() causes refresh token invalidation when rotating tokens are used

#2758 [TDCA Notice] Congratulations — your project has been selected for the TDCA configuration network

#2733 [v2] OAuth discovery validates any /.well-known/openid-configuration document as OIDC, rejecting conforming RFC 8414 metadata

#2748 v1.x and v2 disagree on validating an error result's structuredContent — and the v1.x comment describes the v2 behaviour

#2650 [v2] subscriptions/listen holds a stream open even when it has honoured nothing

#2542 [v2] MRTR wipe-cache example reads unvalidated elicitation content and defaults malformed scope to all

#2751 Server auth defaults silently produce RFC 9728-noncompliant discovery when the MCP endpoint has a path

#1968 OAuth resource indicator from protected resource metadata is normalized with a trailing slash

#2657 [v2] classifyNetworkError passes { cause } into SdkError's data slot, so the underlying network error never reaches Error.cause

#2754 [v2] Should raise error at build time if zod outputSchema is not consistent with the structuredContent type