diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1da98c379..bed6564da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- **`@modelcontextprotocol/sdk` 1.30.0 → 1.31.0** in the backend (root
+  lockfile) and the `mcp-docs` sidecar (GHSA-6qxp-vccf-f47h: the OAuth client
+  could send credentials to an authorization server chosen by the MCP server).
+  Neither side uses the SDK's OAuth support, so no code changes; the sidecar
+  now also rejects JSON-RPC batches of more than 100 messages.
 - **OpenTelemetry database spans no longer carry the DB username**
   (GHSA-qqmp-wf37-98f9). `@opentelemetry/auto-instrumentations-node`
   0.78.0 → 0.79.0, `@opentelemetry/sdk-node` 0.220.0 → 0.221.0 and
diff --git a/mcp-docs/package-lock.json b/mcp-docs/package-lock.json
index 1c001b89f..62bf8ef0a 100644
--- a/mcp-docs/package-lock.json
+++ b/mcp-docs/package-lock.json
@@ -724,9 +724,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
-      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.31.0.tgz",
+      "integrity": "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==",
       "license": "MIT",
       "dependencies": {
         "@hono/node-server": "^1.19.9 || ^2.0.5",
diff --git a/package-lock.json b/package-lock.json
index 435613c63..7525a8cc9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3501,9 +3501,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
-      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.31.0.tgz",
+      "integrity": "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==",
       "license": "MIT",
       "dependencies": {
         "@hono/node-server": "^1.19.9 || ^2.0.5",