chore(deps): update dependency @modelcontextprotocol/sdk to v1.32.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.30.1 → 1.32.0

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.0

Compare Source

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in #​2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in #​2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in #​2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in #​2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in #​2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in #​2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in #​2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in #​2931
• chore: bump version to 1.32.0 by @​claude[bot] in #​2935

New Contributors

• @​raashish1601 made their first contribution in #​2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

v1.31.0

Compare Source

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in #​2888
• chore: bump version to 1.31.0 by @​claude[bot] in #​2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Sunday and Saturday (* 0-6 * * 6,0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.