chore(deps): Bump the go group across 1 directory with 5 updates

[dependabot]

Bumps the go group with 5 updates in the /cli directory:

Package	From	To
github.com/knadh/koanf/parsers/yaml	1.1.0	1.1.1
github.com/knadh/koanf/providers/confmap	1.0.0	1.0.1
github.com/knadh/koanf/providers/rawbytes	1.0.0	1.0.1
github.com/knadh/koanf/v2	2.3.5	2.3.6
github.com/modelcontextprotocol/go-sdk	1.6.1	1.7.0

Updates github.com/knadh/koanf/parsers/yaml from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/knadh/koanf/parsers/yaml's releases.

v1.1.1

• 57e89cf Merge pull request #94 from knadh/fix-posflag-callbacks
• d3bad45 Merge pull request #91 from knadh/bug-report-template
• b1985ad Merge pull request #93 from rhnvrm/unit-test-issue-90
• a72baa3 Merge pull request #92 from knadh/fix-posflag-callbacks
• adc0b54 tests: add unit test for #90
• 9e87eba Fix unchanged default posflag value merging via incorrect callback.
• 2f82a14 Merge pull request #87 from mvrahden/feature/filesystem
• 6e9c0a7 Add github issue templates
• 023ecc6 Update README with fs.FS provider
• f7e28d0 fix call to Close on file descriptor
• caeef66 Merge pull request #1 from rhnvrm/feature/filesystem
• 02f42ea fix: add build constraints to maintain compat
• 149144c add fs.FS provider
• 139fe40 Merge pull request #85 from mvrahden/fix/base_test
• 7cc3416 move error assertions and make them error-type dependent
• 0a31536 fix race condition and reduce test time by half
• af2e3f4 simplify and unify test arrangements
• aa62c04 update testify to v1.7.0
• 5234867 Merge pull request #84 from mr-karan/gh_actions
• c79fbc5 feat: Replace Travis with GitHub Actions

Commits

• 57e89cf Merge pull request #94 from knadh/fix-posflag-callbacks
• d3bad45 Merge pull request #91 from knadh/bug-report-template
• b1985ad Merge pull request #93 from rhnvrm/unit-test-issue-90
• a72baa3 Merge pull request #92 from knadh/fix-posflag-callbacks
• adc0b54 tests: add unit test for #90
• 9e87eba Fix unchanged default posflag value merging via incorrect callback.
• 2f82a14 Merge pull request #87 from mvrahden/feature/filesystem
• 6e9c0a7 Add github issue templates
• 023ecc6 Update README with fs.FS provider
• f7e28d0 fix call to Close on file descriptor
• Additional commits viewable in compare view

Updates github.com/knadh/koanf/providers/confmap from 1.0.0 to 1.0.1

Commits

• 75e13d9 Fix multiple large int64 handling issues.
• b133504 skip disabled secret on azure kv read (#437)
• 1aba4ed deps: upgrade go-toml to v2.4.3 (#419)
• d2ffdaa Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln (#427)
• 4f7edbb Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples (#430)
• 31dd449 fix: error on scalar/map type mismatch in MergeStrict regardless of order (#424)
• e09e4c8 fix: report full key var in MergeStrict type-mismatch error message (#418)
• 7a28d59 Exclude nats, vault providers from global workspace and fix CI test commands.
• d511690 Fix test action to use local Go toolchain for different versions.
• 308274c Fix async file provider Watch() test that would race and fail randomly.
• Additional commits viewable in compare view

Updates github.com/knadh/koanf/providers/rawbytes from 1.0.0 to 1.0.1

Commits

• 75e13d9 Fix multiple large int64 handling issues.
• b133504 skip disabled secret on azure kv read (#437)
• 1aba4ed deps: upgrade go-toml to v2.4.3 (#419)
• d2ffdaa Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln (#427)
• 4f7edbb Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples (#430)
• 31dd449 fix: error on scalar/map type mismatch in MergeStrict regardless of order (#424)
• e09e4c8 fix: report full key var in MergeStrict type-mismatch error message (#418)
• 7a28d59 Exclude nats, vault providers from global workspace and fix CI test commands.
• d511690 Fix test action to use local Go toolchain for different versions.
• 308274c Fix async file provider Watch() test that would race and fail randomly.
• Additional commits viewable in compare view

Updates github.com/knadh/koanf/v2 from 2.3.5 to 2.3.6

Release notes

Sourced from github.com/knadh/koanf/v2's releases.

v2.3.6

What's Changed

• fix: error on scalar/map type mismatch in MergeStrict regardless of order by @​upuddu in knadh/koanf#424
• Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples by @​dependabot[bot] in knadh/koanf#430
• Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln by @​dependabot[bot] in knadh/koanf#427
• deps: upgrade go-toml to v2.4.3 by @​GreyXor in knadh/koanf#419
• skip disabled secret on azure kv read by @​genlp in knadh/koanf#437

New Contributors

• @​upuddu made their first contribution in knadh/koanf#424
• @​genlp made their first contribution in knadh/koanf#437

Full Changelog: knadh/koanf@v2.3.5...v2.3.6

Commits

• 75e13d9 Fix multiple large int64 handling issues.
• b133504 skip disabled secret on azure kv read (#437)
• 1aba4ed deps: upgrade go-toml to v2.4.3 (#419)
• d2ffdaa Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln (#427)
• 4f7edbb Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples (#430)
• 31dd449 fix: error on scalar/map type mismatch in MergeStrict regardless of order (#424)
• See full diff in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.7.0

This release brings full support for protocol version 2026-07-28. The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

• mcp: Implement support for SEP-2575 on client side by @​guglielmo-san (#975)
• mcp: Implement server-side support for discover method (SEP-2575) by @​guglielmo-san (#987)
• mcp: Implement stateless server (SEP-2575) by @​guglielmo-san (#965)
• mcp: add support for logging level (SEP-2575) by @​guglielmo-san (#997)
• mcp: Remove resumability and introduce MissingRequiredClientCapability error data by @​guglielmo-san (#1005)
• mcp: remove session header handling in stateless mode by @​maciej-kisiel (#952)
• mcp: do not call DELETE for sessionless & doc adjustments by @​maciej-kisiel (#960)
• mcp: Implement retry on advised supportedVersions in UnsupportedProtocolVersion error by @​guglielmo-san (#989)
• mcp: Enable legacy initialize fallback on any error by @​guglielmo-san (#1014)

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

• mcp: Implement subscriptions/listen rpc (SEP-2575) by @​guglielmo-san (#1007)
• mcp: refactor notification of subscribed sessions by @​guglielmo-san (#1018)

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

• feat: multi-round-trip request implementation (SEP-2322) by @​yarolegovich (#950)

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

• mcp: add ttl for list results (SEP-2549) by @​guglielmo-san (#1008)
• mcp: add Cacheable fields to DiscoverResult by @​guglielmo-san (#1022)

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

... (truncated)

Commits

• bc72835 mcp: fix potential nil-pointer dereference on message send (#1115)
• cc4db25 chore: update conformance (#1114)
• e761950 mcp: avoid double-copy of payload in writeEvent (#1106)
• 2781b8f mcp: derive Mcp-Protocol-Version header from the outgoing message (#1107)
• 827f90b mcp: allow opt-in to cancel handler ctx on aborted POST (#1099)
• 5cb8339 mcp: update return meta in DiscoverResult (SEP-2575) (#1097)
• fa548d7 docs: update docs (#1089)
• 8baa4cc mcp: add return type to subscriptions/listen (#1088)
• 9576afc mcp: wrap unmarshalParams with jsonrpc error (#1087)
• 0a8953d ci: fix nightly runs (#1086)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.