Repository navigation
build(deps): adopt rmcp 3.9.0 for RUSTSEC-2026-0462 - #420
Merged
Merged
Conversation
plusky
force-pushed
the
build/rmcp-3.9.0
branch
from
November 11, 2026 17:39
c3699fd to
8de0a9a
Compare
rmcp 3.9.0 caps unbounded Streamable HTTP client response buffering (16 MiB / 64 KiB); 3.8.0 is now deny-red. toml rides along to 1.2.1 (+serde_spanned/toml_datetime patches). DESIGN.md stamps re-read against 3.9.0: only the inline-version flag's mechanism moved (require_request_metadata bool -> set_inline_protocol_version). Supersedes #418.
plusky
force-pushed
the
build/rmcp-3.9.0
branch
from
November 11, 2026 17:51
8de0a9a to
7a20556
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RUSTSEC-2026-0462 (unbounded Streamable HTTP client response buffering, now 16 MiB / 64 KiB caps) turns deny red on rmcp 3.8.0, so this adopts 3.9.0. toml rides along to 1.2.1 (+serde_spanned/toml_datetime patches).
DESIGN.md stamps re-read against the 3.9.0 sources: negotiate/is_legacy_request/uses_legacy_lifecycle/parse_allowed_authority/waiting/get_tool/DiscoverResult identical; strip gains only skills arms; the inline-version flag moves from a sticky bool to a OnceLock version on the same single stdio path (line cites updated). No new config fields; skills stay undeclared.
Verified: fmt, clippy x2, rustdoc x2, full suite (1054 passed), deny clean, drift check in sync. Supersedes #418.