[dependabot]

Pinned ModelContextProtocol.AspNetCore at 2.3.0.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. McpClient.ServerInfo is nullable — #​1903
   • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
   • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
   • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
   • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

• Correct protocol-version telemetry for stateless server spans #​1810 by @​luisangelrod
• Preserve HTTP errors and correct discovery fallback handling #​1791 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Make modern Streamable HTTP status mapping deterministic #​1837 by @​jstar0
  • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
• Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #​1852 by @​halter73 (co-authored by @​Copilot)
• Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #​1855 by @​scottt732
• Close server stdin before waiting for graceful stdio process exit #​1838 by @​luisangelrod
• Preserve insertion order when listing server tools, prompts, and resources #​1924 by @​PederHP (co-authored by Claude Opus 5.5)
• Allow missing optional server identity in discovery and make ServerInfo nullable #​1903 by @​Coding-Professional
• Include JSON parse details in Streamable HTTP 400 responses #​1844 by @​ump45nose
• Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #​1719 by @​halter73 (co-authored by @​Copilot)
  • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
  • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
• Preserve numeric progress tokens in RequestOptions serialization #​1832 by @​dfedoryshchev
• Dispose legacy SSE POST responses to release connections deterministically #​1841 by @​yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

• Document standing support for new MCP specification revisions #​1826 by @​halter73 (co-authored by @​Copilot)

Test Improvements

• Stabilize discovery-capable test connections while retaining initialization deadlines #​1943 by @​tarekgh

Repository Infrastructure Updates

• Add a source selector for manual documentation publishes #​1828 by @​jeffhandley (co-authored by @​Copilot)
• Update SourceLink's private build dependency to resolve a vulnerable Git dependency #​1873 by @​halter73 (co-authored by @​Copilot)
• Correct obsolete McpServerFactory references in Copilot instructions #​1892 by @​Zir0-93
• Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #​1940

Acknowledgements

• @​scottt732 made their first contribution in #​1855
• @​Zir0-93 made their first contribution in #​1892
• @​Coding-Professional made their first contribution in #​1903
  ... (truncated)

Commits viewable in compare view.