chore(deps): bump the all-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the all-minor-patch group with 3 updates in the / directory: github.com/mattn/go-sqlite3, github.com/modelcontextprotocol/go-sdk and google.golang.org/api.

Updates github.com/mattn/go-sqlite3 from 1.14.48 to 1.14.49

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.49

What's Changed

• Release vtable and cursor handles when SQLite destroys them by @​mattn in mattn/go-sqlite3#1429
• Do not clobber SQLite's default cost estimates in BestIndex by @​mattn in mattn/go-sqlite3#1430
• Translate SQL NULL filter arguments to nil like goVUpdate by @​mattn in mattn/go-sqlite3#1431
• Identify updated row by argv 0 in goVUpdate by @​mattn in mattn/go-sqlite3#1432
• Ignore Used for constraints SQLite marked not usable by @​mattn in mattn/go-sqlite3#1433
• Reject nil module and nil BestIndex result by @​mattn in mattn/go-sqlite3#1434
• Fail upgrade tool on download and write errors by @​mattn in mattn/go-sqlite3#1435
• Fix off-by-one truncating SQL in fuzz target by @​mattn in mattn/go-sqlite3#1436
• Fix wrong results and cursor state sharing in series example by @​mattn in mattn/go-sqlite3#1437
• Use the table name from xCreate args in vtable example by @​mattn in mattn/go-sqlite3#1438
• Close leaked rows in hook example by @​mattn in mattn/go-sqlite3#1439
• Close prepared statement and fail if limit is not enforced in limit example by @​mattn in mattn/go-sqlite3#1440
• Upgrade SQLite to version 3053004 by @​mattn in mattn/go-sqlite3#1442

Full Changelog: mattn/go-sqlite3@v1.14.48...v1.14.49

Commits

• cc41b8c Merge pull request #1442 from mattn/sqlite-amalgamation-3053004
• 18308a8 Upgrade SQLite to version 3053004
• c1a1466 Merge pull request #1440 from mattn/fix-limit-example-stmt-leak
• 18f2ec3 Assert the expected too many SQL variables error
• 210e260 Merge pull request #1439 from mattn/fix-hook-example-rows-leak
• dccd45f Merge pull request #1438 from mattn/fix-vtable-example-declare
• c0861de Quote table name before interpolating into DeclareVTab
• e664cc6 Merge pull request #1437 from mattn/fix-series-vtable-example
• 2195c5d Merge pull request #1436 from mattn/fix-fuzz-off-by-one
• df9873f Merge pull request #1435 from mattn/fix-upgrade-error-handling
• Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.7.0

This release brings full support for protocol version 2026-07-28. The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

• mcp: Implement support for SEP-2575 on client side by @​guglielmo-san (#975)
• mcp: Implement server-side support for discover method (SEP-2575) by @​guglielmo-san (#987)
• mcp: Implement stateless server (SEP-2575) by @​guglielmo-san (#965)
• mcp: add support for logging level (SEP-2575) by @​guglielmo-san (#997)
• mcp: Remove resumability and introduce MissingRequiredClientCapability error data by @​guglielmo-san (#1005)
• mcp: remove session header handling in stateless mode by @​maciej-kisiel (#952)
• mcp: do not call DELETE for sessionless & doc adjustments by @​maciej-kisiel (#960)
• mcp: Implement retry on advised supportedVersions in UnsupportedProtocolVersion error by @​guglielmo-san (#989)
• mcp: Enable legacy initialize fallback on any error by @​guglielmo-san (#1014)

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

• mcp: Implement subscriptions/listen rpc (SEP-2575) by @​guglielmo-san (#1007)
• mcp: refactor notification of subscribed sessions by @​guglielmo-san (#1018)

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

• feat: multi-round-trip request implementation (SEP-2322) by @​yarolegovich (#950)

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

• mcp: add ttl for list results (SEP-2549) by @​guglielmo-san (#1008)
• mcp: add Cacheable fields to DiscoverResult by @​guglielmo-san (#1022)

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

... (truncated)

Commits

• bc72835 mcp: fix potential nil-pointer dereference on message send (#1115)
• cc4db25 chore: update conformance (#1114)
• e761950 mcp: avoid double-copy of payload in writeEvent (#1106)
• 2781b8f mcp: derive Mcp-Protocol-Version header from the outgoing message (#1107)
• 827f90b mcp: allow opt-in to cancel handler ctx on aborted POST (#1099)
• 5cb8339 mcp: update return meta in DiscoverResult (SEP-2575) (#1097)
• fa548d7 docs: update docs (#1089)
• 8baa4cc mcp: add return type to subscriptions/listen (#1088)
• 9576afc mcp: wrap unmarshalParams with jsonrpc error (#1087)
• 0a8953d ci: fix nightly runs (#1086)
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.290.0 to 0.291.0

Release notes

Sourced from google.golang.org/api's releases.

v0.291.0

0.291.0 (2026-07-28)

Features

• all: Auto-regenerate discovery clients (#3666) (e3721ba)
• all: Auto-regenerate discovery clients (#3670) (4067374)
• all: Auto-regenerate discovery clients (#3674) (432658c)
• all: Auto-regenerate discovery clients (#3676) (9998a11)
• all: Auto-regenerate discovery clients (#3678) (b5c5526)
• all: Auto-regenerate discovery clients (#3679) (499d9b1)

Bug Fixes

• transport: Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (#3660) (6bad358)

Changelog

Sourced from google.golang.org/api's changelog.

0.291.0 (2026-07-28)

Features

• all: Auto-regenerate discovery clients (#3666) (e3721ba)
• all: Auto-regenerate discovery clients (#3670) (4067374)
• all: Auto-regenerate discovery clients (#3674) (432658c)
• all: Auto-regenerate discovery clients (#3676) (9998a11)
• all: Auto-regenerate discovery clients (#3678) (b5c5526)
• all: Auto-regenerate discovery clients (#3679) (499d9b1)

Bug Fixes

• transport: Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (#3660) (6bad358)

Commits

• ed60cb7 chore(main): release 0.291.0 (#3669)
• 90fe3d7 revert change to TestNewClient (#3680)
• 499d9b1 feat(all): auto-regenerate discovery clients (#3679)
• 452691c chore(all): update all (#3677)
• b5c5526 feat(all): auto-regenerate discovery clients (#3678)
• 9998a11 feat(all): auto-regenerate discovery clients (#3676)
• 432658c feat(all): auto-regenerate discovery clients (#3674)
• 4067374 feat(all): auto-regenerate discovery clients (#3670)
• 6bad358 fix(transport): use ds.GetUniverseDomain() instead of raw ds.UniverseDomain f...
• e3721ba feat(all): auto-regenerate discovery clients (#3666)
• See full diff in compare view