build(deps): bump mcp from 1.3.0 to 1.5.1 in /docs

[dependabot]

Bumps mcp from 1.3.0 to 1.5.1.

Release notes

Sourced from mcp's releases.

v1.5.1

This release keeps the HTTP client working with json 3.0. That release accepts the options of JSON.parse as keywords only, and Faraday's JSON response middleware, through 2.14.3, passes them as a positional Hash, which Ruby 3 no longer converts, so every JSON body the client received failed as an internal error. The client now parses response bodies itself, the way it already handled streamed ones, and no longer registers the middleware. A malformed JSON body delivered whole by an adapter without streaming support now raises RequestHandlerError with error_type: :parse_error, as the streamed path already did.

Fixed

• Parse HTTP client response bodies without Faraday's JSON middleware, which json 3.0 breaks (#546)

v1.5.0

This release makes the client answer a server's ping with the empty result the specification requires. Earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, so a server that checks liveness dropped their long-lived sessions. On the OAuth side, the embedding application can refuse an authorization request through authorization_request_validator, and stored tokens are refreshed only against the authorization server that issued them: when the server named for a session differs, the client reauthorizes instead of refreshing, and the validator sees the newly named server. Tokens stored by earlier releases carry no issuer and keep refreshing.

Added

• Add authorization_request_validator to let the embedding application refuse an authorization request (#539)

Fixed

• Answer server-to-client pings in the client (#541)

v1.4.0

This release repairs the subscriptions/listen stream. A host that buffers its responses, the documented Rails controller pattern among them, can decline the method with serve_subscriptions_listen: false instead of answering a modern client with a streaming body it cannot render, and the stream's ordering guarantees are enforced: no notification reaches a client before the acknowledgement, and none follows the graceful closing result.

Added

• Add serve_subscriptions_listen: for hosts that cannot hold an SSE stream open (#533)

Fixed

• Deliver subscriptions/listen notifications only after the acknowledgement (#532)
• Serialize subscriptions/listen writes so the graceful result is the final message (#535)

Changelog

Sourced from mcp's changelog.

[1.5.1] - 2026-09-09

This release keeps the HTTP client working with json 3.0. That release accepts the options of JSON.parse as keywords only, and Faraday's JSON response middleware, through 2.14.3, passes them as a positional Hash, which Ruby 3 no longer converts, so every JSON body the client received failed as an internal error. The client now parses response bodies itself, the way it already handled streamed ones, and no longer registers the middleware. A malformed JSON body delivered whole by an adapter without streaming support now raises RequestHandlerError with error_type: :parse_error, as the streamed path already did.

Fixed

• Parse HTTP client response bodies without Faraday's JSON middleware, which json 3.0 breaks (#546)

[1.5.0] - 2026-09-05

This release makes the client answer a server's ping with the empty result the specification requires. Earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, so a server that checks liveness dropped their long-lived sessions. On the OAuth side, the embedding application can refuse an authorization request through authorization_request_validator, and stored tokens are refreshed only against the authorization server that issued them: when the server named for a session differs, the client reauthorizes instead of refreshing, and the validator sees the newly named server. Tokens stored by earlier releases carry no issuer and keep refreshing.

Added

• Add authorization_request_validator to let the embedding application refuse an authorization request (#539)

Fixed

• Answer server-to-client pings in the client (#541)

[1.4.0] - 2026-08-28

This release repairs the subscriptions/listen stream. A host that buffers its responses, the documented Rails controller pattern among them, can decline the method with serve_subscriptions_listen: false instead of answering a modern client with a streaming body it cannot render, and the stream's ordering guarantees are enforced: no notification reaches a client before the acknowledgement, and none follows the graceful closing result.

Added

• Add serve_subscriptions_listen: for hosts that cannot hold an SSE stream open (#533)

Fixed

• Deliver subscriptions/listen notifications only after the acknowledgement (#532)
• Serialize subscriptions/listen writes so the graceful result is the final message (#535)

Commits

• c6a5512 Merge pull request #547 from koic/release_1_5_1
• 3b44ec4 Release 1.5.1
• d0b22ef Merge pull request #546 from koic/parse_json_response_bodies_in_the_client
• d40d901 Keep json below 3.0 on Ruby 2.7.0 through 2.7.2 in the Gemfile
• 09c89ae Parse HTTP client response bodies without Faraday's JSON middleware
• 44af58c Merge pull request #544 from koic/add_event_stream_parser_to_installation_docs
• 0da0291 [Doc] Explain when the HTTP client needs event_stream_parser
• 8a24e50 Merge pull request #543 from koic/release_1_5_0
• 33525d6 Release 1.5.0
• f706cc8 Merge pull request #542 from koic/fix_flaky_listen_keepalive_thread_assertion
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps mcp from 1.3.0 to 1.5.1 in docs/Gemfile.lock. This brings fixes for HTTP client JSON parsing under json 3.0, server ping responses, and subscriptions/listen stream ordering. The transitive simpleidn dependency also updates to 0.3.0. No breaking changes or migration steps required.

^{Written for commit f841bf5. Summary will update on new commits.}