[dependabot]

Bumps the go-dependencies group with 5 updates in the / directory:

Package	From	To
github.com/chromedp/cdproto	0.0.0-20260714215040-dc233986426f	0.157.9
github.com/chromedp/chromedp	0.16.0	0.20.1
github.com/getkin/kin-openapi	0.147.0	0.149.0
github.com/modelcontextprotocol/go-sdk	1.7.0	1.8.0
golang.org/x/time	0.15.0	0.16.0

Updates github.com/chromedp/cdproto from 0.0.0-20260714215040-dc233986426f to 0.157.9

Changelog

Sourced from github.com/chromedp/cdproto's changelog.

Changelog

Each release of cdproto is generated from the Chromium and V8 protocol definitions listed below. The minor version is the Chromium major version. As the protocol definitions deprecate and remove commands, events, types, and fields, any release can contain incompatible changes to the generated API.

Since 2026-10-06 the package builds with Go 1.25 and later. The package cdp/jsonv2 defines the JSON types and funcs that the generated code uses, such as jsonv2.Value and jsonv2.Unmarshal. They are aliases of the standard types with Go 1.27 or GOEXPERIMENT=jsonv2. Otherwise they come from the module github.com/go-json-experiment/json.

v0.157.10 - 2026-10-12

• Chromium: 157.0.8100.1 (was 157.0.8086.1)
• V8: 15.7.108 (was 15.7.37)
• API changes since v0.157.9: 2 incompatible, 8 compatible

By package, as removed, changed and added names:

audits 0 removed 0 changed 1 added cdproto 0 removed 0 changed 1 added debugger 0 removed 0 changed 1 added network 0 removed 0 changed 1 added page 2 removed 0 changed 4 added

v0.157.7 - 2026-10-05

• Chromium: 157.0.8086.1 (was 157.0.8085.3)
• V8: 15.7.37 (was 15.7.33)
• API changes since v0.157.6: 0 incompatible, 0 compatible

v0.157.6 - 2026-10-04

• Chromium: 157.0.8085.3 (was 157.0.8085.2)
• V8: 15.7.33
• API changes since v0.157.5: 0 incompatible, 0 compatible

v0.157.5 - 2026-10-04

• Chromium: 157.0.8085.2 (was 157.0.8085.1)
• V8: 15.7.33
• API changes since v0.157.4: 0 incompatible, 0 compatible

v0.157.4 - 2026-10-03

• Chromium: 157.0.8085.1
• V8: 15.7.33
• API changes since v0.157.3: 72 incompatible, 1 compatible

... (truncated)

Commits

• See full diff in compare view

Updates github.com/chromedp/chromedp from 0.16.0 to 0.20.1

Release notes

Sourced from github.com/chromedp/chromedp's releases.

v0.20.1

Documentation only. The README, the package documentation and the docs have the current versions (chromedp v0.20.0, cdproto v0.157.8, remote v0.2.0), the CI matrix and the release history. The README describes termcast and the 43 programs of chromedp/examples.

v0.20.0

chromedp supports Go 1.25 and later. Before this release, the module needed Go 1.27 (see #1536).

• The JSON types come from github.com/chromedp/cdproto/cdp/jsonv2. With Go 1.27 or GOEXPERIMENT=jsonv2 they are aliases of the types of the standard encoding/json/v2 and jsontext, so the public API is the same. With Go 1.25 and 1.26 they come from github.com/go-json-experiment/json.
• The modules chromedp, remote and test use go 1.25 and cdproto v0.157.8.
• The CI runs Go 1.25, 1.26 and stable on Linux, stable on Windows and macOS, and the experiment and the compatibility tag.

v0.19.1

Documentation only. The README and the package documentation describe termcast, which draws the screen of a page in a terminal, and the 43 programs of chromedp/examples.

v0.19.0

This release adds new actions and options, fixes bugs, and works on Linux, Windows and macOS in CI. See docs/MIGRATION.md for every change.

New

• Tap and TapXY send a touch tap.
• DragAndDrop and DragAndDropXY drag and drop with the mouse and with HTML5 drag and drop.
• Console reads the console, the uncaught exceptions and the browser log of a page as one iterator.
• ExposeFunc calls a Go function from the page, like exposeFunction in Puppeteer.
• PrintToPDF takes options for the paper, the margins, the scale, the page ranges, the header and the footer, the outline and a stream.
• WithNewWindow chooses a window or a tab for a new target. NoInheritEnv starts the browser with only the given variables. WithDetachOnCancel leaves the tab open when the context ends.
• EvalAwaitPromise waits for a promise that an expression returns.

Fixed

• Call on a Target or a Browser returns an error when the connection to the browser is lost, and does not hang.
• The exec allocator keeps the order of the flags.
• WaitNotPresent works with a JSPath that gives null or an empty list.
• Evaluate returns ErrJSNull for null when the type cannot be nil, and Text works on a text node.
• The pipe transport, the allocator and the tests work on Windows and macOS, and the default browser lookup on Windows falls back to Microsoft Edge.

Notes

• Use errors.Is(err, context.Canceled) and not == for the error of a call after the connection was lost.
• The tests run on Linux, Windows and macOS in CI, and every night against the stable, beta and dev channels of headless-shell.
• The module github.com/chromedp/chromedp/remote is unchanged and stays at remote/v0.1.0.

Commits

• dddfecf Sweep the documentation
• 156907f Require chromedp v0.20.0 in the test module
• a5acf48 Require chromedp v0.20.0 in the remote module
• 4a5437d Support Go 1.25 and later
• 3c56b8b Describe termcast and the new examples in the README and the package document...
• 67e1ea2 Update the actions of the workflows to checkout v7 and setup-go v7
• 8b41617 Wait longer for the report of an HTML5 drag, and ignore the Windows pipe swit...
• 7b6b962 Fix three tests that could pass for the wrong reason
• a6e93be Name the variables that a browser can need with NoInheritEnv
• 2bc273c Close the PDF stream when a read fails and document the zero values
• Additional commits viewable in compare view

Updates github.com/getkin/kin-openapi from 0.147.0 to 0.149.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.149.0

What's Changed

• openapi3: accept boolean schemas by @​reuvenharrison in getkin/kin-openapi#1258

Full Changelog: getkin/kin-openapi@v0.148.0...v0.149.0

v0.148.0

What's Changed

• openapi3: do not forget to carry schema format validators over to OAS3.1 by @​fenollp in getkin/kin-openapi#1250
• openapi3: add FormatOfStringForUUIDOfRFC9562 for UUID v6-v8 by @​ChrisJr404 in getkin/kin-openapi#1251
• openapi3: compare multipleOf on exact rationals, not fixed-precision decimals by @​snowyukitty in getkin/kin-openapi#1252
• docs: add inspect.software health badge by @​Nayjest in getkin/kin-openapi#1253
• openapi3: validate prefixItems positionally by @​reuvenharrison in getkin/kin-openapi#1259

New Contributors

• @​ChrisJr404 made their first contribution in getkin/kin-openapi#1251
• @​Nayjest made their first contribution in getkin/kin-openapi#1253

Full Changelog: getkin/kin-openapi@v0.147.0...v0.148.0

Commits

• 1a812b4 openapi3: accept boolean schemas (#1258)
• 9814d1f Merge commit from fork
• 9245cef Merge commit from fork
• 4487f19 Merge commit from fork
• 53c2ab1 openapi3: validate prefixItems positionally (#1259)
• ba23e9d docs: add inspect.software health badge (#1253)
• 94fcebf openapi3: compare multipleOf on exact rationals, not fixed-precision decimals...
• e9e5e11 openapi3: add FormatOfStringForUUIDOfRFC9562 for UUID v6-v8 (#1251)
• df7e8f4 openapi3: do not forget to carry schema format validators over to OAS3.1 (#1250)
• See full diff in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

• internal/json: json nesting depth check by @​yarolegovich (#1200)
• mcp: add an sse event size cap by @​yarolegovich (#1205)
• mcp: add a max request body size of the old transport by @​yarolegovich (#1224)
• oauthex: bound dcr read to 1mb by @​yarolegovich (#1206)
• oauthex: oauth discovery checks by @​yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

• mcp: allow restricting the protocol versions a server supports by @​guglielmo-san (#1199)
• mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @​guglielmo-san (#1143)
• mcp: limit SSE discover supportedVersions to SSE-defined revisions by @​arimu1 (#1121)
• mcp: prefer the negotiated protocol version over the request context by @​gwyszynski-sa (#1163)
• mcp: export ClientSessionOptions.ProtocolVersion by @​arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

• mcp: allow per request Cacheable customization by @​guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

• plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
• blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

• seterroroverwrite
• enableoriginverification
• disablecontenttypecheck

... (truncated)

Commits

• 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
• 830f0b7 mcp: update conformance tests (#1231)
• 12cbafe oauthex: oauth discovery checks (#1220)
• 3632967 mcp: add an sse event size cap (#1205)
• 0d3036f mcp: allow per request Cacheable customization (#1203)
• cb0de64 mcp: add a max request body size of the old transport (#1224)
• 2fdabde mcp: do not check metatada on notifications (#1215)
• 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
• a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
• 8227246 fix: only subscribe when server advertises capability (#1221)
• Additional commits viewable in compare view

Updates golang.org/x/time from 0.15.0 to 0.16.0

Commits

• fb013b3 all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions