chore(deps): upgrade go-sdk to v1.7.0-pre.1 (new MCP spec)

.github/workflows/mcp-diff.yml

@@ -50,7 +50,12 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Run MCP Server Diff
-        uses: SamMorrowDrums/mcp-server-diff@v2.3.5
+        # Pinned to the cross-spec-aware mcp-server-diff v3.0.0 (full SHA required —
+        # Actions rejects shortened SHAs): normalizes _meta plumbing, cache hints,
+        # initialize envelope, tool-annotation default hints; probes each server at its
+        # own newest spec via the stateless SEP-2575 server/discover path. Keeps the
+        # go-sdk v1.6.1 -> v1.7.0-pre.1 bump an honest, signal-only diff. github/copilot-mcp-core#1709.
+        uses: SamMorrowDrums/mcp-server-diff@3521651bb0d3cc267a23df8d94a2a645556980a4 # v3.0.0
         with:
           setup_go: "false"
           install_command: |
@@ -114,7 +119,8 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Run MCP Server Diff (streamable-http)
-        uses: SamMorrowDrums/mcp-server-diff@v2.3.5
+        # Pinned to mcp-server-diff v3.0.0 — see rationale on the stdio job above.
+        uses: SamMorrowDrums/mcp-server-diff@3521651bb0d3cc267a23df8d94a2a645556980a4 # v3.0.0
         with:
           setup_go: "false"
           install_command: |

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/josephburnett/jd/v2 v2.5.0
 	github.com/lithammer/fuzzysearch v1.1.8
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/modelcontextprotocol/go-sdk v1.6.1
+	github.com/modelcontextprotocol/go-sdk v1.7.0-pre.1
 	github.com/muesli/cache2go v0.0.0-20221011235721-518229cd8021
 	github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
 	github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466
@@ -41,8 +41,10 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -39,8 +39,8 @@ github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8
 github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
-github.com/modelcontextprotocol/go-sdk v1.6.1 h1:0zOSupjKUxPKSocPT1Wtago+mUHU2/uZ4xSOY0FGReU=
-github.com/modelcontextprotocol/go-sdk v1.6.1/go.mod h1:kzm3kzFL1/+AziGOE0nUs3gvPoNxMCvkxokMkuFapXQ=
+github.com/modelcontextprotocol/go-sdk v1.7.0-pre.1 h1:GlMIJyMHFX76bBSQuBCLXZ7pB9cGh4VBS6O5wGd0tgI=
+github.com/modelcontextprotocol/go-sdk v1.7.0-pre.1/go.mod h1:dL7u98E/zjJTGzEq+j30jQ8K2k1mb6LeAH4inEcSGts=
 github.com/muesli/cache2go v0.0.0-20221011235721-518229cd8021 h1:31Y+Yu373ymebRdJN1cWLLooHH8xAr0MhKTEJGV/87g=
 github.com/muesli/cache2go v0.0.0-20221011235721-518229cd8021/go.mod h1:WERUkUryfUWlrHnFSO/BEUZ+7Ns8aZy7iVOGewxKzcc=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
@@ -99,6 +99,8 @@ golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwE
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -117,6 +119,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
 golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

pkg/github/__toolsnaps__/actions_get.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get details of GitHub Actions resources (workflows, workflow runs, jobs, and artifacts)"
   },

pkg/github/__toolsnaps__/actions_list.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "List GitHub Actions workflows in a repository"
   },

pkg/github/__toolsnaps__/actions_run_trigger.snap

@@ -1,6 +1,8 @@
 {
   "annotations": {
     "destructiveHint": true,
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Trigger GitHub Actions workflow actions"
   },
   "description": "Trigger GitHub Actions workflow operations, including running, re-running, cancelling workflow runs, and deleting workflow run logs.",

pkg/github/__toolsnaps__/add_comment_to_pending_review.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Add review comment to the requester's latest pending pull request review"
   },
   "description": "Add review comment to the requester's latest pending pull request review. A pending review needs to already exist to call this (check with the user if not sure).",

pkg/github/__toolsnaps__/add_issue_comment.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Add comment to issue or pull request"
   },
   "description": "Add a comment and/or reaction to a specific issue or issue comment in a GitHub repository. Use this tool with pull requests as well (in this case pass pull request number as issue_number), but only if user is not asking specifically to add or react to review comments. At least one of body or reaction is required.",

pkg/github/__toolsnaps__/add_issue_comment_reaction.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Add Reaction to Issue or Pull Request Comment"
   },
   "description": "Add a reaction to an issue or pull request comment.",

pkg/github/__toolsnaps__/add_issue_reaction.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Add Reaction to Issue or Pull Request"
   },
   "description": "Add a reaction to an issue or pull request.",

pkg/github/__toolsnaps__/add_pull_request_review_comment.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Add Pull Request Review Comment"
   },
   "description": "Add a review comment to the current user's pending pull request review.",

pkg/github/__toolsnaps__/add_pull_request_review_comment_reaction.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Add Pull Request Review Comment Reaction"
   },
   "description": "Add a reaction to a pull request review comment.",

pkg/github/__toolsnaps__/add_reply_to_pull_request_comment.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Add reply to pull request comment"
   },
   "description": "Add a reply and/or reaction to an existing pull request comment. This can create a new comment linked as a reply to the specified comment, add an emoji reaction to the specified comment, or do both. At least one of body or reaction is required.",

pkg/github/__toolsnaps__/add_sub_issue.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Add Sub-Issue"
   },
   "description": "Add a sub-issue to a parent issue.",

pkg/github/__toolsnaps__/assign_copilot_to_issue.snap

@@ -1,6 +1,7 @@
 {
   "annotations": {
     "idempotentHint": true,
+    "readOnlyHint": false,
     "title": "Assign Copilot to issue"
   },
   "description": "Assign Copilot to a specific issue in a GitHub repository.\n\nThis tool can help with the following outcomes:\n- a Pull Request created with source code changes to resolve the issue\n\n\nMore information can be found at:\n- https://docs.github.com/en/copilot/using-github-copilot/using-copilot-coding-agent-to-work-on-tasks/about-assigning-tasks-to-copilot\n",

pkg/github/__toolsnaps__/create_branch.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Create branch"
   },
   "description": "Create a new branch in a GitHub repository",

pkg/github/__toolsnaps__/create_gist.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Create Gist"
   },
   "description": "Create a new gist",

pkg/github/__toolsnaps__/create_issue.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Create Issue"
   },
   "description": "Create a new issue in a GitHub repository with a title and optional body.",

pkg/github/__toolsnaps__/create_or_update_file.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Create or update file"
   },
   "description": "Create or update a single file in a GitHub repository. \nIf updating, you should provide the SHA of the file you want to update. Use this tool to create or update a file in a GitHub repository remotely; do not use it for local file operations.\n\nIn order to obtain the SHA of original file version before updating, use the following git command:\ngit rev-parse \u003cbranch\u003e:\u003cpath to file\u003e\n\nSHA MUST be provided for existing file updates.\n",

pkg/github/__toolsnaps__/create_pull_request.snap

@@ -9,6 +9,8 @@
     }
   },
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Open new pull request"
   },
   "description": "Create a new pull request in a GitHub repository.",

pkg/github/__toolsnaps__/create_pull_request_review.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": false,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Create Pull Request Review"
   },
   "description": "Create a review on a pull request. If event is provided, the review is submitted immediately; otherwise a pending review is created.",

pkg/github/__toolsnaps__/create_repository.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Create repository"
   },
   "description": "Create a new GitHub repository in your account or specified organization",

pkg/github/__toolsnaps__/delete_file.snap

@@ -1,6 +1,8 @@
 {
   "annotations": {
     "destructiveHint": true,
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Delete file"
   },
   "description": "Delete a file from a GitHub repository",

pkg/github/__toolsnaps__/delete_pending_pull_request_review.snap

@@ -1,7 +1,9 @@
 {
   "annotations": {
     "destructiveHint": true,
+    "idempotentHint": false,
     "openWorldHint": true,
+    "readOnlyHint": false,
     "title": "Delete Pending Pull Request Review"
   },
   "description": "Delete a pending pull request review.",

pkg/github/__toolsnaps__/discussion_comment_write.snap

@@ -1,6 +1,8 @@
 {
   "annotations": {
     "destructiveHint": true,
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Manage discussion comments"
   },
   "description": "Write operations for discussion comments.\nSupports adding top-level comments, replying to existing comments, updating comment content, deleting comments, and marking or unmarking comments as the answer.",

pkg/github/__toolsnaps__/dismiss_notification.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Dismiss notification"
   },
   "description": "Dismiss a notification by marking it as read or done",

pkg/github/__toolsnaps__/fork_repository.snap

@@ -1,5 +1,7 @@
 {
   "annotations": {
+    "idempotentHint": false,
+    "readOnlyHint": false,
     "title": "Fork repository"
   },
   "description": "Fork a GitHub repository to your account or specified organization",

pkg/github/__toolsnaps__/get_code_quality_finding.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get code quality finding"
   },

pkg/github/__toolsnaps__/get_code_scanning_alert.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get code scanning alert"
   },

pkg/github/__toolsnaps__/get_commit.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get commit details"
   },

pkg/github/__toolsnaps__/get_dependabot_alert.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get dependabot alert"
   },

pkg/github/__toolsnaps__/get_discussion.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get discussion"
   },

pkg/github/__toolsnaps__/get_discussion_comments.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get discussion comments"
   },

pkg/github/__toolsnaps__/get_file_blame.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get file blame information"
   },

pkg/github/__toolsnaps__/get_file_contents.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get file or directory contents"
   },

pkg/github/__toolsnaps__/get_gist.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get Gist Content"
   },

pkg/github/__toolsnaps__/get_global_security_advisory.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get a global security advisory"
   },

pkg/github/__toolsnaps__/get_label.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get a specific label from a repository"
   },

pkg/github/__toolsnaps__/get_latest_release.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get latest release"
   },

pkg/github/__toolsnaps__/get_me.snap

@@ -9,6 +9,7 @@
     }
   },
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get my user profile"
   },

pkg/github/__toolsnaps__/get_notification_details.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get notification details"
   },

pkg/github/__toolsnaps__/get_release_by_tag.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get a release by tag name"
   },

pkg/github/__toolsnaps__/get_repository_tree.snap

@@ -1,5 +1,6 @@
 {
   "annotations": {
+    "idempotentHint": false,
     "readOnlyHint": true,
     "title": "Get repository tree"
   },