Fetching from the wire…
01
02
03
04
05
06
07
08
Infra2026-09-03 · source-backed
PR #3426, merged September 2, backports session lifecycle ownership: session_idle_timeout existed on StreamableHTTPSessionManager but defaulted to None and couldn't be set from FastMCP, so at stock settings a session whose client never sent DELETE stayed registered until process exit. Concurrent sessions now cap at 10,000 by default with a 503 beyond it. Both defaults are active where there was previously no limit, so this changes behavior for anyone running a stateful MCP server. Pass None on either keyword to restore the old unbounded behavior.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol's 2026-07-28 revision is the biggest change since the protocol existed. The core is now stateless request/response instead of a bidirectional stateful session. Authorization aligns with OAuth 2.1 and OpenID Connect. MCP Apps and Tasks moved under a v...
Released early August 11, the implicit default model becomes gpt-5.6-luna, and local MCP support now spans Python SDK v1 and v2 across stdio, SSE, and Streamable HTTP. If you have custom MCP HTTP auth or client factories, you match the installed MCP major version's HTTP types...
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
GitHub published four advisories against omnigent-ai/omnigent v0.1.0, the meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h at CVSS 9.0 lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{i...
Released September 2, this build fixes managed settings silently going unenforced when the managed-settings file, a drop-in, the MDM plist, or the HKLM value fails to parse. Claude Code now refuses to launch and names the source. It also fixes concurrent sessions silently reve...
upstash/context7 (60,590 stars) shipped @upstash/[redacted] on August 7 on the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are gone, which is a real operational simplification for anyone self-hosting...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.