chore(deps): bump the cli-deps group in /cli with 2 updates

[dependabot]

Bumps the cli-deps group in /cli with 2 updates: github.com/mattn/go-runewidth and github.com/modelcontextprotocol/go-sdk.

Updates github.com/mattn/go-runewidth from 0.0.28 to 0.0.30

Commits

• 14205cc Merge pull request #110 from mattn/truncate-rune-fast-path
• 67f0b8d Take the rune fast path in the Truncate functions too
• a42811d Merge pull request #111 from mattn/wrap-invalid-utf8
• 1156ade Keep strings that are not valid UTF-8 on the segmenter
• 06120a9 Merge pull request #109 from mattn/skip-segmentation-without-joiners
• 21388ad Skip grapheme segmentation for text that cannot form clusters
• 6c7068f Generate a table of runes that can join a grapheme cluster
• 2793dc5 Merge pull request #108 from youdie006/fix-wrap-grapheme-cluster
• fd7c07f Add Wrap benchmarks for the ASCII, CJK and emoji paths
• f5f115c Inline the ASCII width rule in the Wrap fast path
• Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

• internal/json: json nesting depth check by @​yarolegovich (#1200)
• mcp: add an sse event size cap by @​yarolegovich (#1205)
• mcp: add a max request body size of the old transport by @​yarolegovich (#1224)
• oauthex: bound dcr read to 1mb by @​yarolegovich (#1206)
• oauthex: oauth discovery checks by @​yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

• mcp: allow restricting the protocol versions a server supports by @​guglielmo-san (#1199)
• mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @​guglielmo-san (#1143)
• mcp: limit SSE discover supportedVersions to SSE-defined revisions by @​arimu1 (#1121)
• mcp: prefer the negotiated protocol version over the request context by @​gwyszynski-sa (#1163)
• mcp: export ClientSessionOptions.ProtocolVersion by @​arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

• mcp: allow per request Cacheable customization by @​guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

• plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
• blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

• seterroroverwrite
• enableoriginverification
• disablecontenttypecheck

... (truncated)

Commits

• 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
• 830f0b7 mcp: update conformance tests (#1231)
• 12cbafe oauthex: oauth discovery checks (#1220)
• 3632967 mcp: add an sse event size cap (#1205)
• 0d3036f mcp: allow per request Cacheable customization (#1203)
• cb0de64 mcp: add a max request body size of the old transport (#1224)
• 2fdabde mcp: do not check metatada on notifications (#1215)
• 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
• a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
• 8227246 fix: only subscribe when server advertises capability (#1221)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions