build(deps): bump mcp/sdk from 0.6.0 to 0.7.0

[dependabot]

Bumps mcp/sdk from 0.6.0 to 0.7.0.

Release notes

Sourced from mcp/sdk's releases.

v0.7.0

What's Changed

• [Server] Fix completion/complete crash for plain ref/resource by @​NarimanGardi in modelcontextprotocol/php-sdk#388
• [Server] Harden JSON-RPC input parsing against malformed input and resource exhaustion by @​soyuka in modelcontextprotocol/php-sdk#383
• [Server] scope OAuth to resource server, not authorization server by @​soyuka in modelcontextprotocol/php-sdk#382
• [Server] Allow pre-built instance handlers in element registration by @​valeriudev in modelcontextprotocol/php-sdk#375
• [Schema] Fix Implementation::fromArray rejecting falsy-but-valid name/version by @​DevkumarPatel in modelcontextprotocol/php-sdk#393
• [Client] Add client-side elicitation support by @​wachterjohannes in modelcontextprotocol/php-sdk#371
• [Server] Defer element loading to first registry read by @​soyuka in modelcontextprotocol/php-sdk#389
• [Server] Always emit items for array tool parameter schemas by @​valeriudev in modelcontextprotocol/php-sdk#378
• [Server] Reject malformed MCP session ID headers by @​jstar0 in modelcontextprotocol/php-sdk#384
• [Examples] Demo pre-built instance handlers + inspector coverage by @​chr-hertel in modelcontextprotocol/php-sdk#390
• [Server] Expose OAuth protected resource metadata as a reusable request handler by @​chr-hertel in modelcontextprotocol/php-sdk#391
• [Minor] Preserve custom domain on docs deploy by @​chr-hertel in modelcontextprotocol/php-sdk#374
• [Minor] bump actions/checkout from 6 to 7 by @​dependabot[bot] in modelcontextprotocol/php-sdk#385
• [Minor] bump actions/setup-node from 6 to 7 by @​dependabot[bot] in modelcontextprotocol/php-sdk#394
• [Minor] Fix v0.7.0 CHANGELOG entries by @​chr-hertel in modelcontextprotocol/php-sdk#396

New Contributors

• @​NarimanGardi made their first contribution in modelcontextprotocol/php-sdk#388
• @​valeriudev made their first contribution in modelcontextprotocol/php-sdk#375
• @​DevkumarPatel made their first contribution in modelcontextprotocol/php-sdk#393
• @​jstar0 made their first contribution in modelcontextprotocol/php-sdk#384

Full Changelog: modelcontextprotocol/php-sdk@v0.6.0...v0.7.0

Changelog

Sourced from mcp/sdk's changelog.

0.7.0

• Add client-side elicitation support: ElicitationCallbackInterface, ElicitationRequestHandler, and ElicitationException let clients respond to server elicitation requests.
• Defer element loading to the first registry read: loaders now run at request time (first has*/get* call) instead of eagerly at Builder::build(), fixing empty registries under persistent runtimes (e.g. FrankenPHP worker mode) where a loader's data source is not ready at build time. Adds Builder::setLazyLoading() (default on), a public Registry::load(), and an optional LoaderInterface constructor argument on Registry.
• [BC Break] Element loading is lazy by default: loader failures now surface on the first request rather than at Builder::build(), and initialize advertises capabilities from the configured sources rather than the loaded registry. Call Builder::setLazyLoading(false) to restore eager build-time loading.
• Allow [$instance, 'methodName'] as an element handler in Builder::addTool(), addResource(), addResourceTemplate(), and addPrompt(). Unblocks handlers with constructor dependencies that the container-less new $className() fallback cannot build.
• Always emit an items schema for array tool parameters: untyped arrays get items: {} and nullable typed arrays (e.g. string[]|null) keep their element type. Fixes strict clients rejecting tools with "array type must have items" (#151).
• Harden JSON-RPC input parsing: single-message vs batch is now decided from the decoded JSON type (object → single, list array → batch) instead of the raw first byte. Scalars, empty payloads, and non-object batch elements are surfaced as InvalidInputMessageException entries instead of triggering warnings or a TypeError.
• Add maxBatchSize (default 100) to MessageFactory — oversized JSON-RPC batches are rejected before any message is constructed, guarding against amplification.
• Add maxBodyBytes (default 4 MiB) to StreamableHttpTransport — POST bodies exceeding the cap are rejected with 413. Unknown-size/chunked bodies are read incrementally and stopped at the cap so they cannot exhaust memory.
• Reject malformed Mcp-Session-Id headers with a 400 response: a repeated header or a value that is not a valid UUID is now rejected up front instead of surfacing as an uncaught Uuid::fromString() error.
• Extract RFC 9728 metadata serving into ProtectedResourceMetadataHandler, a transport-neutral PSR-15 RequestHandlerInterface that can be mounted directly as a Symfony/Laravel controller; ProtectedResourceMetadataMiddleware now delegates to it (no BC break).

Commits

• a6f4155 Fix v0.7.0 CHANGELOG entries (#396)
• 0058d93 [Server] Expose OAuth protected resource metadata as a reusable request handl...
• 1fed089 [Examples] Demo pre-built instance handlers + inspector coverage (#390)
• d187002 [Server] Reject malformed MCP session ID headers (#384)
• 8e18bfb [Server] Always emit items for array tool parameter schemas (#378)
• ff91ca6 [Server] Defer element loading to first registry read (#389)
• e4a8a22 [Client] Add client-side elicitation support (#371)
• 206aa9d [Schema] Fix Implementation::fromArray rejecting falsy-but-valid name/version...
• 12f4a78 chore(deps): bump actions/setup-node from 6 to 7 (#394)
• 55f7884 [Server] Allow pre-built instance handlers in element registration (#375)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)