chore(deps): bump the sdk version to 1.7.0

[mcncl]

Description

Bumps the go-sdk version to v1.7.0 and add fix for Capabilities with new spec.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​modelcontextprotocol/​go-sdk@​v1.7.0-pre.3 ⏵ v1.7.0	+1

View full report

[Copilot]

Pull request overview

Updates the Buildkite MCP server to use github.com/modelcontextprotocol/go-sdk v1.7.0 and adjusts server initialization to avoid advertising the deprecated logging capability by default under the updated MCP spec behavior.

Changes:

• Bump github.com/modelcontextprotocol/go-sdk from v1.7.0-pre.3 to v1.7.0.
• Initialize mcp.ServerOptions.Capabilities with a non-nil empty mcp.ServerCapabilities{} to prevent default advertising of the deprecated logging capability.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/server/mcp.go	Sets an explicit (empty) server capabilities object to prevent deprecated logging capability from being advertised by default.
go.mod	Bumps github.com/modelcontextprotocol/go-sdk dependency to v1.7.0.
go.sum	Updates checksums for the go-sdk v1.7.0 upgrade.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfeidau]

NICE 👍🏻

[buildsworth-bk-app]

The SDK option matches its documented capability-inference behavior; I left one non-blocking coverage suggestion. This changes the server's advertised MCP protocol contract, so this is a comment-only review from me.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 9366, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. To let it approve, grant L2 approval by mentioning @buildsworth-bk (see L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only with an L2 grant; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

[buildsworth-bk-app]

Non-blocking: An over-the-wire test of the advertised capability set would protect the behavior this change is fixing; the existing server tests still pass if this option is removed. ClientSession.InitializeResult().Capabilities can assert that Logging is nil while tools, prompts, and resources remain inferred.