build(deps): bump mcp/sdk from 0.7.0 to 0.7.1

[dependabot]

Bumps mcp/sdk from 0.7.0 to 0.7.1.

Release notes

Sourced from mcp/sdk's releases.

v0.7.1

What's Changed

• Hardening transports
• Fix codestyle pipeline on main by @​chr-hertel in modelcontextprotocol/php-sdk#402
• Fix 'notifcation' typo in docs by @​latent-9 in modelcontextprotocol/php-sdk#410

New Contributors

• @​latent-9 made their first contribution in modelcontextprotocol/php-sdk#410

Full Changelog: modelcontextprotocol/php-sdk@v0.7.0...v0.7.1

Changelog

Sourced from mcp/sdk's changelog.

Changelog

All notable changes to mcp/sdk will be documented in this file.

0.8.0

• Always emit {} for empty tool schemas: Tool recursively normalizes every empty sub-schema — properties, items, additionalProperties, $defs, combinators and the other draft-07 to 2020-12 schema keywords — in the constructor, for both inputSchema and outputSchema, so an object position is never serialized as [].
• Prompt generators returning content as typed arrays (['type' => 'text', ...] etc.) no longer lose the optional fields: annotations on every content type, and _meta and an explicit mimeType on embedded resource contents, now carry through to the resulting PromptMessage instead of being silently dropped. A missing resource mimeType still defaults to text/plain/application/octet-stream as before.
• Add annotations support to ImageContent (constructor, fromArray(), fromFile(), fromString(), jsonSerialize()), matching TextContent and AudioContent.
• Add client-side roots/list handler (ListRootsRequestHandler + RootsCallbackInterface) and Client::sendRootsListChanged(), plus server-side ClientGateway::listRoots() / supportsRoots() and ListRootsResult::fromArray().
• Add ClientGateway::supportsSampling(), so a tool can check the client's advertised capabilities before issuing a sampling/createMessage request instead of asking and catching the refusal. Matches the existing supportsRoots() and supportsElicitation().
• [BC Break] Gate structuredContent on the negotiated protocol revision: ToolReference::extractStructuredContent() takes an optional ProtocolVersion and, for revisions predating SEP-2106 (2025-11-25 and earlier, where structuredContent must be a JSON object), returns null for a tool result that is a PHP list or an object serializing to a JSON array. From 2026-07-28 on both are emitted as-is. Objects serializing to a scalar and arrays holding Content instances are never emitted, in any revision. CallToolHandler resolves the revision from the request's _meta (modern era) or the session (handshake era) and falls back to the strictest rule; it logs a warning when a tool declares an outputSchema but returns a value that cannot be sent, and when a self-built CallToolResult carries a structuredContent the revision does not allow (that one is passed through unchanged). Tools returning a list against an older client keep their JSON-encoded value in content; they just no longer advertise an invalid structuredContent.
• Add Mcp\Schema\Content\ResourceLink for the spec's resource_link content block (protocol revision 2025-06-18+), letting tool results and prompt messages reference a resource by URI/name without embedding its contents. Accepted anywhere resource (EmbeddedResource) content is (de)serialized: CallToolResult::fromArray(), PromptMessage::fromArray(), and PromptResultFormatter.
• Negotiate the protocol revision during the initialize handshake: the server echoes a revision it supports and counter-offers ProtocolVersion::latestHandshake() otherwise (Builder::setProtocolVersion() pins it to exactly one), and the client fails the handshake on a counter-offer it cannot speak rather than continuing on an unagreed revision. Adds Client::getProtocolVersion(), the 2026-07-28 revision, and the era helpers on ProtocolVersion — revisions from 2026-07-28 on have no initialize, so they are excluded from negotiation and from ProtocolVersionMiddleware's default supported set.
• Add sampling with tools support: sampling requests now accept tools and tool-choice preferences, messages support tool-use/tool-result content blocks and multiple content blocks, and clients can advertise the sampling.context and sampling.tools capabilities. Adds ClientGateway::supportsSamplingTools() / supportsSamplingContext() to check the sub-capabilities before sending, and CreateSamplingMessageRequest::validateToolFlow(), which asserts the spec's tool-flow rules across the whole message list — the client handler rejects a violating request with -32602 instead of leaving it unanswered, and the gateway refuses to send one.
• [BC Break] SamplingMessage::$content and CreateSamplingMessageResult::$content may now hold a list of content blocks instead of a single one, so code reading them directly must handle both. Use the new getContentBlocks() on either class to always get a list.
• [BC Break] CreateSamplingMessageResult now rejects any role other than assistant, and rejects empty content, as the specification requires.

Commits

• 785fc3b Fix 'notifcation' typo in docs (#410)
• 9a6d24c Fix codestyle pipeline for 0.7.1 (#402)
• 9aa18f3 Merge commit from fork
• 529099f Merge commit from fork
• 055593f Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)