chore(deps): update dependency @modelcontextprotocol/sdk to v1.32.1

[ferrlabs-renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@modelcontextprotocol/sdk (source)	1.31.0 → 1.32.1

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.1

Compare Source

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in #​2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in #​2942
• chore: bump version to 1.32.1 by @​claude[bot] in #​2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

v1.32.0

Compare Source

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in #​2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in #​2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in #​2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in #​2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in #​2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in #​2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in #​2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in #​2931
• chore: bump version to 1.32.0 by @​claude[bot] in #​2935

New Contributors

• @​raashish1601 made their first contribution in #​2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Lockfile-only minor bump of @modelcontextprotocol/sdk (1.31.0 to 1.32.0), within the existing ^1.0.0 specifier in both importers. Same zod peer and no change to the transitive dependency set. Nothing blocking. CI was still queued when I looked, so let Test & Build and the dependency scans finish before merging.

[ferrfleet]

Since my last review, the lockfile has moved from 1.32.0 to 1.32.1. This is a patch bump that stays within ^1.0.0. The zod peer and the transitive dependency set are unchanged, and I found nothing blocking.

Nit: the PR title still says v1.32.0.

CI is still running on this commit. Wait for Test & Build and osv-scanner to pass before merging.