[dependabot]

Bumps rmcp from 3.5.1 to 3.6.0.

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.6.0

Fixed

• (transport) accept nested x-mcp-header annotations (#1359)
• ship LICENSE in rmcp and rmcp-macros crates (#1342)

Other

• combine AI issue triage with a maintainer rotation as the responsible reviewer (#1260)

rmcp-v3.6.0

Added

• (client) cancel an abandoned tools/call, prompts/get or resources/read (#1344)
• (auth) add initial authorization scope selection (#1352)
• (transport) add non-blocking stdio_pipes transport (#1304)

Fixed

• (server) reject requests to 2026-07-28 clients (#1326)
• (streamable-http-server) look up tool schemas per request (#1349)
• (transport) follow same-origin 307/308 redirects in the default Streamable HTTP client (#1367)
• (streamable-http-server) answer a session-less non-initialize POST with 400 (#1377)
• (model) read a request id written in float form as that integer (#1346)
• (client) answer a server ping during the initialize handshake (#1366)
• (transport) accept nested x-mcp-header annotations (#1359)
• (streamable-http-client) handle error responses to initialize (#1361)
• (transport) bound the incoming line buffer in AsyncRwTransport (#1049)
• (model) reject malformed JSON-RPC messages with conflicting result and error fields (#1283) (#1287)
• ship LICENSE in rmcp and rmcp-macros crates (#1342)
• (streamable-http-server) release the session map lock before waiting on a session (#1323)
• (rmcp) gate client- and server-only helpers behind their features (#1329)
• cancel pending request tokens after transport EOF (#1333)
• (rmcp) import base64-only prompt content types under the feature (#1314)

Other

• combine AI issue triage with a maintainer rotation as the responsible reviewer (#1260)

Commits

• 74d7895 chore: release v3.6.0 (#1327)
• ad2a66a fix(server): reject requests to 2026-07-28 clients (#1326)
• c519c79 fix(streamable-http-server): look up tool schemas per request (#1349)
• be386d5 fix(transport): follow same-origin 307/308 redirects in the default Streamabl...
• 50fba5c fix(streamable-http-server): answer a session-less non-initialize POST with 4...
• 017e1c3 fix(model): read a request id written in float form as that integer (#1346)
• ad5a284 ci(labeler): drop path-based T-dependencies rule (#1368)
• a156be8 fix(client): answer a server ping during the initialize handshake (#1366)
• b7568b8 fix(transport): accept nested x-mcp-header annotations (#1359)
• ce3a57a feat(client): cancel an abandoned tools/call, prompts/get or resources/read (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #109.