Added
- (auth) structure protected resource discovery errors (#1305)
- (transport) log followed same-origin redirects at debug level (#1417)
- support the Skills extension (SEP-2640) (#1392)
Fixed
- (model) don't treat _meta alone as a CallToolResult (#1405)
- (client) keep ProgressDispatcher lock off the await path (#1310)
- (auth) refresh with only granted scopes (#1331)
- streamable-http server: stateful session workers ignore config.canc (#1427)
- (skills) enforce manifest boundaries and capability negotiation (#1412)
- (transport) send SIGTERM before killing a child process on graceful shutdown (#1379)
- (handler) generate a tool's outputSchema for the serialize contract (#1378)
- (server) reject server-to-client requests on discover sessions (#1397)
- (auth) accept ID-JAGs without a resource claim (#1406)
- (rmcp) reject Mcp-Param headers with invalid characters (#1414)
- (transport) match explicit HTTP media types and Accept quality values (#1382)
- (model) accept URL elicitation requests without elicitationId (#1383)
- (transport) preserve protocol error replies across cancellation (#1370)