xarmian cf09cf7520 chore(deps): bump mcp-go to v0.56.0, advance yaml/v4 to rc.6 (TASK-2060) (#916) ...

Bump github.com/mark3labs/mcp-go v0.52.0 -> v0.56.0 and
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6.

mcp-go v0.56 turns on DNS-rebinding protection by default in the
Streamable HTTP server: a request whose accept socket is loopback but
whose Host header is non-loopback is rejected with 403. pad-cloud's
mcp.getpad.dev vhost sits behind a reverse proxy that forwards to the
process over 127.0.0.1 while preserving the original Host, so the new
default would 403 every real MCP request. Restore the pre-v0.56
behaviour with WithDisableLocalhostProtection(true) — the transport
only mounts in cloud mode and every request is Bearer/OAuth-authed, so
the browser-driven rebinding threat the guard targets doesn't apply.

yaml/v4 has no stable v4.0.0 (latest tag is rc.6); advance along the RC
line rather than migrate the four artifact/openapi yaml.Node call sites
to yaml.v3 (format-sensitive, higher-risk). Zero code churn.

Claude-Session: https://claude.ai/code/session_015yuBJQYfDj95cgX3DaD8SF

2026-07-11 09:20:02 -04:00

..

loadtest-collab

fix(loadtest): codex catch-up review fixes (TASK-1270) (#470)

2026-05-09 16:41:07 -04:00

pad

chore(deps): bump mcp-go to v0.56.0, advance yaml/v4 to rc.6 (TASK-2060) (#916)

2026-07-11 09:20:02 -04:00