[dependabot]

Bumps the bundler group with 2 updates in the /mcp-client-ruby directory: anthropic and mcp.
Bumps the bundler group with 1 update in the /weather-server-ruby directory: mcp.

Updates anthropic from 1.78.0 to 1.80.0

Release notes

Sourced from anthropic's releases.

v1.80.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints
• tests: cover trace context propagation and failing telemetry

Documentation

• api: note that some models need a beta header to use speed

v1.79.0

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass open_telemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: ignore OpenTelemetry env vars when the option is set
• client: keep the discriminator when a union's .new builds a variant
• streaming: keep every field of a tool use block when attaching its parsed input
• streaming: pass events of an unknown type through the message stream helper untouched
• tools: name the toolset on the tool runner's result for a toolset member's call

Chores

• docs: correct prefill, thinking, fallback and model descriptions
• docs: document the scope required to assign the managed role
• docs: update model examples
• include the license files in the published packages
• internal: narrow the tripwire test rule in the contributor guides

... (truncated)

Changelog

Sourced from anthropic's changelog.

1.80.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints
• tests: cover trace context propagation and failing telemetry

Documentation

• api: note that some models need a beta header to use speed

1.79.0 (2026-10-14)

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass open_telemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: ignore OpenTelemetry env vars when the option is set
• client: keep the discriminator when a union's .new builds a variant
• streaming: keep every field of a tool use block when attaching its parsed input
• streaming: pass events of an unknown type through the message stream helper untouched
• tools: name the toolset on the tool runner's result for a toolset member's call

Chores

• docs: correct prefill, thinking, fallback and model descriptions
• docs: document the scope required to assign the managed role
• docs: update model examples
• include the license files in the published packages
• internal: narrow the tripwire test rule in the contributor guides

... (truncated)

Commits

• 3727c3d release: 1.80.0
• ed1ae86 Merge pull request #320 from anthropics/synced/published
• a5fdb3e feat(helpers): retry a rate-limited fast fallback at standard speed (#327)
• 1b08817 chore(tests): cover trace context propagation and failing telemetry
• 9e473cf feat(api): add between_tools to thinking types in model capabilities
• fd0b7a4 chore(docs): describe headers on Managed Agents and telemetry endpoints
• 05186fa docs(api): note that some models need a beta header to use speed
• 3119978 fix(helpers): honour speed overrides from fallback entries when streaming (#326)
• 048926c docs(changelog): shorten the OpenTelemetry tracing note (#325)
• 6fad576 feat(api): add the speed parameter and usage.speed to Messages
• Additional commits viewable in compare view

Updates mcp from 1.7.0 to 1.8.0

Release notes

Sourced from mcp's releases.

v1.8.0

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

Changelog

Sourced from mcp's changelog.

[1.8.0] - 2026-10-16

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

Commits

• 56af0c7 Merge pull request #618 from koic/release_1_8_0
• 28ec269 Release 1.8.0
• 157ab51 Merge pull request #596 from koic/close_a_failed_listen_stream_from_the_path_...
• 0019b4d Merge pull request #614 from koic/allow_the_end_to_end_host_under_dns_rebindi...
• 820b65c Allow the end-to-end test's host under DNS rebinding protection
• 9d12f51 Merge pull request #600 from koic/accept_any_2xx_acknowledgement_of_a_notific...
• 2527cba Merge pull request #597 from koic/state_the_modern_status_of_a_require_scopes...
• 243c19a Accept any 2xx acknowledgement of a notification in the HTTP client
• 7735046 Merge pull request #595 from koic/bound_the_listen_teardown_on_transport_close
• 6d40d4c Close a failed listen stream only from the path that removed its entry
• Additional commits viewable in compare view

Updates mcp from 1.7.0 to 1.8.0

Release notes

Sourced from mcp's releases.

v1.8.0

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

Changelog

Sourced from mcp's changelog.

[1.8.0] - 2026-10-16

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

• Add OAuth 2.1 resource server support (#545)
• Add a scope selector for OAuth authorization-code clients (#579)

Changed

• Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

• Redact the Authorization header from the errors the HTTP transport retains (#591)
• Close a refused SSE stream outside the registry lock (#592)
• Let the session reaper finish before the transport closes (#593)
• Bound the subscriptions/listen teardown on transport close (#595)
• Close a failed subscriptions/listen stream only from the path that removed its entry (#596)
• Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

Commits

• 56af0c7 Merge pull request #618 from koic/release_1_8_0
• 28ec269 Release 1.8.0
• 157ab51 Merge pull request #596 from koic/close_a_failed_listen_stream_from_the_path_...
• 0019b4d Merge pull request #614 from koic/allow_the_end_to_end_host_under_dns_rebindi...
• 820b65c Allow the end-to-end test's host under DNS rebinding protection
• 9d12f51 Merge pull request #600 from koic/accept_any_2xx_acknowledgement_of_a_notific...
• 2527cba Merge pull request #597 from koic/state_the_modern_status_of_a_require_scopes...
• 243c19a Accept any 2xx acknowledgement of a notification in the HTTP client
• 7735046 Merge pull request #595 from koic/bound_the_listen_teardown_on_transport_close
• 6d40d4c Close a failed listen stream only from the path that removed its entry
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions