chore(deps-dev): bump mcp from 1.6.1 to 1.7.0 in the bundler-dependencies group

[dependabot]

Bumps the bundler-dependencies group with 1 update: mcp.

Updates mcp from 1.6.1 to 1.7.0

Release notes

Sourced from mcp's releases.

v1.7.0

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

Changelog

Sourced from mcp's changelog.

[1.7.0] - 2026-10-05

This release lets a web application finish the OAuth authorization in the request that receives the redirect, bounds the initialize request a session retains and the resource URIs a subscriptions/listen stream retains, validates icons given as Hashes through MCP::Icon, and repairs two subscriptions/listen cases: a request that cannot be encoded is refused, and a removed stream is marked closed. The two bounds and the icon validation reject what earlier releases accepted and ship in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md; raise max_initialize_request_bytes: and max_resource_subscription_bytes: (or set them to nil) where the byte bounds are too tight, and give Hash icons only the MCP::Icon members with a valid src.

Added

• Let a web application finish authorization in the request that receives the redirect (#573)
• Bound the resource URIs a subscriptions/listen stream retains (#582)
• Bound the initialize request a session retains (#583)

Changed

• Validate icons given as Hashes through MCP::Icon (#586)

Fixed

• Refuse subscriptions/listen requests that cannot be encoded (#585)
• Mark a removed subscriptions/listen stream closed (#587)

Commits

• d4202c2 Merge pull request #588 from koic/release_1_7_0
• 6cb9875 Release 1.7.0
• 745bc61 Merge pull request #587 from koic/mark_removed_listen_streams_closed
• cc88656 Merge pull request #586 from koic/validate_icons_given_as_hashes
• 0cef024 Mark a removed subscriptions/listen stream closed
• 402cb56 Merge pull request #585 from koic/refuse_listen_requests_that_cannot_be_encoded
• 73d6da3 Merge pull request #584 from koic/describe_the_pending_authorization_checks_a...
• a49ab43 Validate icons given as Hashes through MCP::Icon
• 739dd55 Refuse subscriptions/listen requests that cannot be encoded
• 095bd81 [Doc] Describe the pending authorization checks as the code establishes them
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

posthog-ruby-sync Compliance Report

Date: 2026-10-14T21:30:08.265497+00:00
Duration: 94333ms

⚠️ Some Tests Failed

45/47 tests passed, 2 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	10ms
Format Validation.Event Has Uuid	✅	7ms
Format Validation.Event Has Lib Properties	✅	6ms
Format Validation.Distinct Id Is String	✅	9ms
Format Validation.Token Is Present	✅	6ms
Format Validation.Custom Properties Preserved	✅	6ms
Format Validation.Event Has Timestamp	✅	6ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	6ms
Retry Behavior.Retries On 503	✅	5383ms
Retry Behavior.Does Not Retry On 400	✅	2011ms
Retry Behavior.Does Not Retry On 401	✅	2009ms
Retry Behavior.Respects Retry After Header	✅	8018ms
Retry Behavior.Implements Backoff	✅	15372ms
Retry Behavior.Retries On 500	✅	5163ms
Retry Behavior.Retries On 502	✅	5143ms
Retry Behavior.Retries On 504	✅	5117ms
Retry Behavior.Max Retries Respected	✅	15579ms
Deduplication.Generates Unique Uuids	✅	18ms
Deduplication.Preserves Uuid On Retry	✅	5115ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10334ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5170ms
Deduplication.No Duplicate Events In Batch	✅	18ms
Deduplication.Different Events Have Different Uuids	✅	9ms
Compression.Sends Gzip When Enabled	✅	6ms
Batch Format.Uses Proper Batch Structure	✅	6ms
Batch Format.Flush With No Events Sends Nothing	✅	3ms
Batch Format.Multiple Events Batched Together	❌	22ms
Error Handling.Does Not Retry On 403	✅	2008ms
Error Handling.Does Not Retry On 413	✅	2010ms
Error Handling.Retries On 408	✅	5116ms

Failures

batch_format.multiple_events_batched_together

Expected 1 requests, got 5

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	9ms
Request Payload.Flags Request Uses V2 Query Param	✅	6ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	7ms
Request Payload.Flags Request Omits Authorization Header	✅	7ms
Request Payload.Token In Flags Body Matches Init	✅	7ms
Request Payload.Groups Round Trip	✅	7ms
Request Payload.Groups Default To Empty Object	✅	6ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	8ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	7ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	6ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	5ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	10ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	6ms
Retry Behavior.Retries Flags On 502	✅	152ms
Retry Behavior.Retries Flags On 504	✅	111ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	10ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']

[github-actions]

posthog-ruby-async Compliance Report

Date: 2026-10-14T21:30:15.065732+00:00
Duration: 98213ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

---

Capture Tests

✅ 30/30 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	9ms
Format Validation.Event Has Uuid	✅	106ms
Format Validation.Event Has Lib Properties	✅	108ms
Format Validation.Distinct Id Is String	✅	107ms
Format Validation.Token Is Present	✅	107ms
Format Validation.Custom Properties Preserved	✅	107ms
Format Validation.Event Has Timestamp	✅	107ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	10ms
Retry Behavior.Retries On 503	✅	5311ms
Retry Behavior.Does Not Retry On 400	✅	2109ms
Retry Behavior.Does Not Retry On 401	✅	2109ms
Retry Behavior.Respects Retry After Header	✅	8016ms
Retry Behavior.Implements Backoff	✅	15723ms
Retry Behavior.Retries On 500	✅	5212ms
Retry Behavior.Retries On 502	✅	5212ms
Retry Behavior.Retries On 504	✅	5212ms
Retry Behavior.Max Retries Respected	✅	15522ms
Deduplication.Generates Unique Uuids	✅	112ms
Deduplication.Preserves Uuid On Retry	✅	5213ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10318ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5215ms
Deduplication.No Duplicate Events In Batch	✅	111ms
Deduplication.Different Events Have Different Uuids	✅	107ms
Compression.Sends Gzip When Enabled	✅	106ms
Batch Format.Uses Proper Batch Structure	✅	107ms
Batch Format.Flush With No Events Sends Nothing	✅	4ms
Batch Format.Multiple Events Batched Together	✅	111ms
Error Handling.Does Not Retry On 403	✅	2108ms
Error Handling.Does Not Retry On 413	✅	2109ms
Error Handling.Retries On 408	✅	5212ms

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	107ms
Request Payload.Flags Request Uses V2 Query Param	✅	108ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	109ms
Request Payload.Flags Request Omits Authorization Header	✅	109ms
Request Payload.Token In Flags Body Matches Init	✅	108ms
Request Payload.Groups Round Trip	✅	107ms
Request Payload.Groups Default To Empty Object	✅	106ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	107ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	107ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	107ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	106ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	110ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	106ms
Retry Behavior.Retries Flags On 502	✅	210ms
Retry Behavior.Retries Flags On 504	✅	253ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	109ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']