Merge branch 'main' into fix/1081-empty-handler-response

Author: ZYZ666-RGB

.github/workflows/ci.yml

@@ -2,6 +2,7 @@ name: CI
 
 on:
   pull_request: {}
+  workflow_dispatch: {}
 
 jobs:
   build:

.github/workflows/conformance.yml

@@ -27,7 +27,7 @@ jobs:
           timeout 30 bash -c 'until curl -s http://localhost:8080/mcp > /dev/null 2>&1; do sleep 0.5; done'
 
       - name: Run conformance tests
-        uses: modelcontextprotocol/conformance@v0.1.11
+        uses: modelcontextprotocol/conformance@v0.1.16
         with:
           mode: server
           url: http://localhost:8080/mcp
@@ -54,7 +54,7 @@ jobs:
         run: mvn clean install -DskipTests
 
       - name: Run conformance test
-        uses: modelcontextprotocol/conformance@v0.1.11
+        uses: modelcontextprotocol/conformance@v0.1.16
         with:
           mode: client
           command: 'java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-*-SNAPSHOT.jar'

.gitignore

@@ -65,4 +65,5 @@ site/
 .profiler/
 s3.properties
 .*.swp
-.DS_Store
+.DS_Store
+.envrc

CHANGELOG.md

@@ -0,0 +1,73 @@
+# Changelog
+
+All notable changes to the MCP Java SDK are documented in the
+[GitHub Releases](https://github.com/modelcontextprotocol/java-sdk/releases),
+which serve as the canonical, detailed changelog for every version. This file
+summarizes the release history and the currently maintained release lines.
+
+Versioning follows [Semantic Versioning](https://semver.org/); see
+[VERSIONING.md](VERSIONING.md) for the breaking-change policy and
+[SECURITY.md](SECURITY.md) for the supported-versions security policy.
+
+## Release lines
+
+| Line   | Latest | Spec revision | Status |
+|--------|--------|---------------|--------|
+| 2.0.x  | [2.0.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.1) (2026-08-19) | 2025-11-25 | Active development |
+| 1.1.x  | [1.1.4](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.4) (2026-08-19) | 2025-06-18 | Security patches only |
+| 0.18.x | [0.18.4](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.4) (2026-08-19) | 2025-06-18 | Security patches only |
+
+## 2.0.1 — 2026-08-19
+
+- Bound STDIO and HTTP client/server reads to a configurable maximum size
+
+Full notes: [v2.0.1 release](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.1)
+
+## 2.0.0 — 2026-06-11
+
+First major release since 1.x, tracking the **2025-11-25** MCP specification.
+Upgrading from 1.x? See the [v2 migration guide](MIGRATION-2.0.md).
+
+- New JSON compatibility foundation for forward/backward wire compatibility,
+  with pluggable Jackson 2 / Jackson 3 serialization modules
+- Spec-accurate schema: enforced required fields, lenient wire deserialization
+- End-to-end validation of tool inputs and embedded JSON Schema documents
+  (JSON Schema 2020-12, SEP-1613)
+- Richer elicitation: client-side schema defaults (SEP-1034), URL elicitation
+  (SEP-1036), form-based elicitation schemas
+- Icons and metadata support (SEP-973)
+- Streamable HTTP first: SSE transports deprecated in favor of Streamable HTTP
+- Module restructuring: `mcp-core`, `mcp-json-jackson2`, `mcp-json-jackson3`,
+  `mcp-bom`
+
+Full notes: [v2.0.0 release](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0)
+(preceded by milestones [M1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M1),
+[M2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M2),
+[M3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M3),
+[RC1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-RC1)).
+
+## 1.x
+
+- [1.1.4](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.4) — 2026-08-19:
+  bound HTTP client/server reads (backport)
+- [1.1.3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.3) /
+  [1.0.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.2) — 2026-05-21:
+  SSE client transport message-endpoint validation (backports)
+- [1.1.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.2) — 2026-04-25
+- [1.1.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.1) /
+  [1.0.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.1) — 2026-03-27
+- [1.1.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.0) — 2026-03-13
+- [1.0.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0) — 2026-02-23:
+  first stable release; see the [1.0 migration guide](MIGRATION-1.0.md)
+
+## 0.x
+
+- [0.18.4](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.4) — 2026-08-19:
+  bound HTTP client/server reads (backport)
+- [0.18.3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.3) — 2026-06-09:
+  security fix for GHSA-hv2w-8mjj-jw22
+- [0.18.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.0) –
+  [0.18.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.2) — 2026-02 to 2026-05
+- [0.8.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.8.0) –
+  [0.17.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.17.2) — 2025-03 to 2026-01:
+  see the [full release list](https://github.com/modelcontextprotocol/java-sdk/releases)

CONTRIBUTING.md

@@ -35,6 +35,12 @@ propose an enhancement. Bug reports should have a reproducer in the form of a co
 sample or a repository attached that the maintainers or contributors can work with to 
 address the problem.
 
+## AI agents
+
+**We accept contributions created with the help of AI coding agents, but they must be carefully reviewed by a human who remains accountable for the quality of the contribution.**
+These can be issues or pull requests. For issues, please ensure you describe your particular use-case, and not general considerations found by an AI agent.
+Contributions submitted by GitHub accounts controlled by autonomous AI bots are forbidden.
+
 ## Making Changes
 
 1. Create a new branch:
@@ -63,15 +69,25 @@ git checkout -b feature/your-feature-name
 
 ## Submitting Changes
 
+Please don't submit pull requests:
+
+- With GitHub accounts managed by autonomous AI bots
+- For already assigned issues (as the assignee is or plans to work on it)
+
+When submitting changes:
+
 1. For non-trivial changes, please clarify with the maintainers in an issue whether 
    you can contribute the change and the desired scope of the change.
 2. For trivial changes (for example a couple of lines or documentation changes) there 
    is no need to open an issue first.
-3. Push your changes to your fork.
-4. Submit a pull request to the main repository.
-5. Follow the pull request template.
-6. Wait for review.
-7. For any follow-up work, please add new commits instead of force-pushing. This will 
+3. Maintainers will triage issues and act on them. There is no such guarantee on pull requests.
+   PRs opened without being discussed in an issue MAY be ignored, and maintainers reserve the right
+   to close these PRs without justification.
+4. Push your changes to your fork.
+5. Submit a pull request to the main repository.
+6. Follow the pull request template.
+7. Wait for review.
+8. For any follow-up work, please add new commits instead of force-pushing. This will
    allow the reviewer to focus on incremental changes instead of having to restart the 
    review process.
 

ROADMAP.md

@@ -6,40 +6,35 @@ The SDK tracks implementation of MCP spec components via GitHub Projects, with a
 
 ## Current Focus Areas
 
-### 2025-11-25 Spec Implementation
+### 2.x — Stable Line (2025-11-25 spec)
 
-The Java SDK is actively implementing the [2025-11-25 MCP specification revision](https://github.com/orgs/modelcontextprotocol/projects/26/views/1).
+The current stable release line is **2.x** (latest: [2.0.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.1), August 2026), implementing the [2025-11-25 MCP specification revision](https://modelcontextprotocol.io/specification/2025-11-25), including:
 
-Key features in this revision include:
+- **Spec-accurate schema**: enforced required fields with lenient wire deserialization, and a JSON compatibility foundation for forward/backward wire compatibility
+- **Enhanced schemas**: JSON Schema 2020-12 validation of tool inputs and embedded schema documents (SEP-1613)
+- **Richer elicitation**: client-side schema defaults (SEP-1034), URL mode elicitation (SEP-1036), form-based elicitation schemas
+- **Icons metadata** (SEP-973): icons for tools, resources, resource templates, and prompts
+- **Streamable HTTP first**: SSE transports deprecated in favor of Streamable HTTP
+- **Pluggable JSON serialization**: Jackson 2 and Jackson 3 modules
 
-- **Tasks**: Experimental support for tracking durable requests with polling and deferred result retrieval
-- **Tool calling in sampling**: Support for `tools` and `toolChoice` parameters
-- **URL mode elicitation**: Client-side URL elicitation requests
-- **Icons metadata**: Servers can expose icons for tools, resources, resource templates, and prompts
-- **Enhanced schemas**: JSON Schema 2020-12 as default, improved enum support, default values for elicitation
-- **Security improvements**: Updated security best practices, enhanced authorization flows, enabling OAuth integrations
+2.x development continues with patch and minor releases for bug fixes, conformance improvements, and non-breaking features. See [CHANGELOG.md](CHANGELOG.md) for the release history.
 
-See the full [changelog](https://modelcontextprotocol.io/specification/2025-11-25/changelog) for details.
+The earlier **1.x and 0.x release lines receive security patches only** — no feature or bug-fix backports. Users on those lines are encouraged to upgrade via the [v2 migration guide](MIGRATION-2.0.md).
 
-### Tier 1 SDK Support
+### 3.x — 2026-07-28 Spec Support
 
-Once we catch up on the most recent MCP specification revision we aim to fully support all the upcoming specification features on the day of its release.
+The next major version, **3.x**, will implement the [2026-07-28 MCP specification revision](https://modelcontextprotocol.io/specification/2026-07-28), including `server/discover` and the SEP-2575 stateless lifecycle. The first 3.0.0 milestone releases are planned for **September 2026**, tracked via a dedicated spec revision project board.
 
-### v1.x Development
+### SDK Tiering
 
-The Java SDK is currently in active development as v1.x, following a recent stable 1.0.0 release. The SDK provides:
+The Java SDK is an official [Tier 2 SDK](https://modelcontextprotocol.io/community/sdk-tiers) committed to full protocol support: new spec revisions are implemented within the Tier 2 six-month window, with conformance continuously verified against the [MCP conformance suite](https://github.com/modelcontextprotocol/conformance) in CI. Once caught up on the most recent specification revision, we aim for Tier 1: fully supporting new specification features on the day of their release.
 
-- MCP protocol implementation
-- Synchronous and asynchronous programming models
-- Multiple transport options (STDIO, HTTP/SSE, Servlet)
-- Pluggable JSON serialization (Jackson 2 and Jackson 3)
-
-Development is tracked via [GitHub Issues](https://github.com/modelcontextprotocol/java-sdk/issues) and [GitHub Projects](https://github.com/orgs/modelcontextprotocol/projects).
-
-### Future Versions
+### Future Directions
 
 Major version updates will align with MCP specification changes and breaking API changes as needed. The SDK is designed to evolve with the Java ecosystem, including:
 
 - Virtual Threads and Structured Concurrency support
 - Additional transport implementations
 - Performance optimizations
+
+Development is tracked via [GitHub Issues](https://github.com/modelcontextprotocol/java-sdk/issues) and [GitHub Projects](https://github.com/orgs/modelcontextprotocol/projects).

VERSIONING.md

@@ -41,6 +41,14 @@ The following are **not** considered breaking:
 3. **Migration guide**: Major version releases include a migration guide describing what changed and how to update.
 4. **PR labels**: Pull requests containing breaking changes are labeled with `breaking change`.
 
+## Release lines
+
+| Line   | Latest | Spec revision | Status |
+|--------|--------|---------------|--------|
+| 2.0.x  | [2.0.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.1) (2026-08-19) | 2025-11-25 | Active development |
+| 1.1.x  | [1.1.4](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.4) (2026-08-19) | 2025-06-18 | Security patches only |
+| 0.18.x | [0.18.4](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.4) (2026-08-19) | 2025-06-18 | Security patches only |
+
 ## Maven Coordinates
 
 All SDK modules share the same version number and are released together. The BOM (`mcp-bom`) provides dependency management for all SDK modules to ensure version consistency.