Go SDK 1.8.0 hardens transports against resource exhaustion and lets servers narrow protocol versions

The official Go SDK released v1.8.0 on 2026-09-14, described in the release notes as "equivalent to v1.8.0-pre.2," the pre-release that opened the cycle on 2026-09-04. The release adds no new protocol revision: "the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates."

Most of the release bounds decoding paths that previously buffered input without a limit. JSON payloads are rejected past 1000 levels of nesting before the parser recurses (#1200); MaxEventSize on SSEClientTransport and StreamableClientTransport caps the bytes buffered for a single SSE event (#1205); StdioTransport.MaxLineLength caps a single JSON-RPC frame; and OAuth dynamic client registration responses are bounded to 1MB (#1206), with the discovery code now validating metadata documents rather than trusting them (#1220).

Two additions give servers more control over what they advertise. ServerOptions.SupportedProtocolVersions lets a server narrow, never widen, the set of protocol versions it negotiates; naming an unimplemented version panics at construction (#1199). ServerOptions.SetCacheable is a new hook that sets the ttlMs and cacheScope fields on results from server/discover, the four list methods, and resources/read, running once per result after the handler returns (#1203). Two behavior changes from the hardening work are guarded by new MCPGODEBUG flags, plaintextstatefulrejection and blockingcancelnotify, both slated for removal in v1.9.0; four legacy MCPGODEBUG options were removed in this release.