Upgrade github.com/modelcontextprotocol/go-sdk to v1.3.1 (security patch)#16923
Upgrade github.com/modelcontextprotocol/go-sdk to v1.3.1 (security patch)#16923
Conversation
…tch) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Upgrades github.com/modelcontextprotocol/go-sdk to v1.3.1 to pick up a security fix in MCP JSON message parsing, and updates module metadata accordingly.
Changes:
- Bump
github.com/modelcontextprotocol/go-sdkfromv1.3.0tov1.3.1. - Add/update indirect dependencies and checksums in
go.mod/go.sum. - Reformat/regenerate
docs/public/editor/autocomplete-data.jsonoutput.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Updates go-sdk version and adds new indirect deps (segmentio/encoding, segmentio/asm). |
| go.sum | Updates checksums for go-sdk v1.3.1 and new indirect dependencies. |
| docs/public/editor/autocomplete-data.json | Large formatting/regeneration change to the generated editor autocomplete dataset. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "roles": { | ||
| "type": "string|array", | ||
| "desc": "Repository access roles required to trigger agentic workflows.", | ||
| "enum": [ | ||
| "all" | ||
| ], | ||
| "enum": ["all"], | ||
| "leaf": true, | ||
| "array": true | ||
| }, |
There was a problem hiding this comment.
This PR includes a large reformat of docs/public/editor/autocomplete-data.json, but the PR description states only go.mod/go.sum changes. Since this JSON is generated (see docs/scripts/generate-autocomplete-data.js), either (a) revert this file to keep the security dependency bump focused, or (b) explicitly note in the PR description that the autocomplete data was regenerated and why, to avoid confusion/noise for reviewers.
v1.3.1fixes a security issue in MCP message parsing by replacing Go's standardencoding/jsondecoder withgithub.com/segmentio/encoding, which enforces case-sensitive struct field matching — closing an attack vector where case-insensitive matching could be exploited by malicious MCP clients.Changes
go.mod: bumpedgithub.com/modelcontextprotocol/go-sdkv1.3.0→v1.3.1; addedgithub.com/segmentio/asm v1.1.3andgithub.com/segmentio/encoding v0.5.3as new indirect depsgo.sum: updated checksums accordinglyWarning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -nolocalimports -importcfg git 3322�� /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/access_log.go 3322473/b433/_testmain.go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -w -buildmode=exe git rev-�� --show-toplevel -extld=gcc /opt/hostedtoolcache/node/24.13.0/x64/bin/node -template-expresgit x_amd64/link /usr/bin/git node(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 8505/001/stability-test.md credential.helper ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha /tmp/go-build681252616/b062/_pkg_.a -trimpath /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -p github.com/githurev-parse -lang=go1.25 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -uns�� -unreachable=false /tmp/go-build1233322473/b070/vet.cfg 3322473/b353/vet.cfg -c=4 -nolocalimports -importcfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha --noprofile(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha /tmp/TestHashConsistency_GoAndJavaScript3226424535/001/test-fron-p(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 701449661/.github/workflows .cfg 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha limc/pYgGOytTB_XG49gUlimc -buildtags ipts.test -errorsas -ifaceassert -nilfunc ipts.test 2333�� -test.paniconexit0 3322473/b406/_testmain.go /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -b feature-branch /usr/bin/git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -c=4 -nolocalimports -importcfg /tmp/go-build1233322473/b394/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil_test.go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build1233322473/b402/importcfg -pack /tmp/go-build1233322473/b402/_testmain.go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha 05(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --show-toplevel(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha 05(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --show-toplevel pRla9x3p1t5h ache/node/24.13.--show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet rev-�� --show-toplevel ache/node/24.13.0/x64/bin/node /usr/bin/git /tmp/TestHashCongit(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git runs/20260219-22git -buildtags /opt/hostedtoolc--show-toplevel r rev-�� --count ..feature-branch /usr/bin/git -unreachable=falgit /tmp/go-build123rev-parse /opt/hostedtoolc--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu/tmp/go-build1233322473/b416/_testmain.go /usr/bin/wc runs/20260219-22git /tmp/go-build123rev-parse /opt/hostedtoolc--show-toplevel wc -l(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet er: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabl--show-toplevel otEi1LiCN -buildtags /opt/hostedtoolc--get grep ^Fro�� archie.md 3322473/b371/importcfg /usr/bin/git k/gh-aw/gh-aw/pkgit stmain.go ache/go/1.25.0/x--git-dir git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/cut -unreachable=falgit l /opt/hostedtoolc--show-toplevel cut -f1(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linuTest User /usr/bin/git runs/20260219-22git -buildtags /opt/hostedtoolc--show-toplevel git form�� ..feature-branch --stdout /usr/bin/git -bool(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/du -bool -buildtags /opt/hostedtoolc--show-toplevel du -k /tmp/gh-aw/aw.patch /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git -unreachable=falgit l /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linutest@example.com /usr/bin/ls -bool -buildtags /opt/hostedtoolc--show-toplevel r -lh /tmp/gh-aw/aw.patch /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linuowner/repo 0/x64/bin/node -bool -buildtags om/testorg/testr--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel 6bf67e90..HEAD /usr/bin/git --get-regexp .cfg 64/pkg/tool/linuuser.email git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git --local credential.helpeconfig ache/go/1.25.0/x--get git(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git .go .go x_amd64/link git rev-�� ub/workflows x_amd64/link /usr/bin/git g_.a credential.helpeconfig ache/go/1.25.0/xuser.name git(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion -unreachable=falgit(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo _TOKEN"; }; f(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo _TOKEN"; }; f ced successfully/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/node(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build1233322473/b380/cli.test /tmp/go-build1233322473/b380/cli.test -test.testlogfile=/tmp/go-build1233322473/b380/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true(http block)/tmp/go-build3960234348/b001/cli.test /tmp/go-build3960234348/b001/cli.test -test.testlogfile=/tmp/go-build3960234348/b001/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=5m0s -test.run=^Test -test.short=true(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name inputs.version x_amd64/vet /usr/bin/git(http block)If you need me to access, download, or install something from one of these locations, you can either:
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.