[jeffhandley]

Release v1.4.2

This patch release includes security fixes for OAuth authentication and authenticated HTTP sessions, alongside documentation and release-publishing maintenance.

Release Notes

What's Changed

• Validate OAuth PKCE support and metadata issuer [release/1.x] Validate OAuth PKCE support and metadata issuer #1949 by @halter73 (co-authored by @PranavSenthilnathan @copilot)

Deployments using metadata-free 2025-03-26 OAuth discovery may explicitly enable the legacy endpoint fallback only after independently verifying PKCE enforcement; otherwise, update metadata to advertise S256. The process-wide opt-in is ModelContextProtocol.Authentication.AllowLegacyOAuthMetadataFallback; it does not bypass validation of discovered metadata.

• Harden authenticated HTTP session handling (7c5d15e) by @halter73 (co-authored by @jeffhandley @PranavSenthilnathan @copilot)

Documentation Updates

• Sanitize 1.x documentation Sanitize 1.x documentation #1729 by @jeffhandley
• Document standing support for new MCP revisions [release/1.x] Document standing support for new MCP revisions #1827 by @jeffhandley (co-authored by @halter73 @copilot)

Repository Infrastructure Updates

• Update SourceLink for 1.x documentation builds Update 1.x SourceLink to unblock documentation publishing #1944 by @jeffhandley (co-authored by @copilot)
• Enable CodeQL for release branches [release/1.x] Enable CodeQL for release branches #1947 by @halter73 (co-authored by @copilot)
• Add versioned docs publishing infrastructure [release/1.x] Add versioned docs publishing infrastructure #1980 by @jeffhandley (co-authored by @copilot)
• Fix Markdown link-check warnings and outdated Skills specification link [release/1.x] Fix Markdown link-check warnings and outdated Skills specification link #1978 by @jeffhandley (co-authored by @copilot)

Acknowledgements

• @halter73 @jeffhandley @PranavSenthilnathan @tarekgh reviewed pull requests

Full Changelog: v1.4.1...v1.4.2

Note

These release notes were drafted with GitHub Copilot.

---

API Compatibility Report

PackageValidationBaselineVersion is 1.0.0 (unchanged). Final plain dotnet clean -c Release; dotnet pack -c Release passed. Core generated 8 entries, exactly matching its 8 tracked suppressions; the other two packages generated none. No compatibility-suppression files changed.

Package	Baseline	Generated suppressions	Retained / removed	Plain Release pack
ModelContextProtocol.Core	1.0.0	8	8 / 0	Pass
ModelContextProtocol	1.0.0	0	0 / 0	Pass
ModelContextProtocol.AspNetCore	1.0.0	0	0 / 0	Pass

API Diff Report

ApiDiff 10.0.405-servicing.26552.105 compared published v1.4.1 net10.0 assemblies with final v1.4.2 Release/net10.0 assemblies. All three fresh, non-empty generated reports show no public API additions, removals, or changes.

Package	Generated report
ModelContextProtocol.Core	No API changes.
ModelContextProtocol	No API changes.
ModelContextProtocol.AspNetCore	No API changes.

Note

This pull request description was prepared with GitHub Copilot.