This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summarySession-level protocol version tracking enforces MCP initialization lifecycle across all transports.
Full changelog
[3.0.10] - 2026-03-26
Fixed
- 3.0.9 publish was missing changes — Re-publish includes all session-level version tracking,
ServerBuilder::with_protocol(),ProtocolConfigprelude re-export,stdio::run_with_config(),SessionStatelifecycle enforcement, and versioned routing across all transports.
Added
-
Session-level protocol version tracking across all transports — Every transport (STDIO, HTTP, TCP, Unix, WebSocket) now stores the negotiated
ProtocolVersionafter a successfulinitializehandshake and routes all subsequent requests throughroute_request_versioned, applying the correct version adapter for response filtering. Previously, version-aware routing was only available at the protocol layer; transports bypassed it. -
MCP initialization lifecycle enforcement —
SessionStateenum (Uninitialized/Initialized(ProtocolVersion)) enforces the MCP spec requirement thatinitializemust succeed before any other method is accepted. Pre-init requests are rejected with a clear error. Duplicateinitializerequests are rejected. Lifecycle notifications (notifications/initialized,notifications/cancelled) pass through unconditionally. -
ServerBuilder::with_protocol()— New builder method to configure protocol version negotiation (e.g.,ProtocolConfig::multi_version()) through the high-level builder API. -
ProtocolConfigre-exported from prelude —turbomcp::prelude::ProtocolConfigis now available for ergonomic multi-version server setup. -
stdio::run_with_config()— New entry point for STDIO transport that acceptsServerConfig, enabling multi-version protocol support for STDIO-based servers. -
3 new transport-layer tests —
test_line_transport_ping_after_init(verifies requests succeed after init),test_line_transport_rejects_before_init(verifies pre-init rejection),test_line_transport_rejects_duplicate_init(verifies duplicate init rejection).
Changed
-
adapter_for_version()returns&'static dyn VersionAdapter— ReplacedBox<dyn VersionAdapter>with static references to zero-sized adapter instances, eliminating per-request heap allocation. -
HTTP
SessionManagerstores per-session protocol version —SessionDatastruct replaces barebroadcast::Sender, bundling the SSE channel with an optionalProtocolVersion. Newset_protocol_version()/get_protocol_version()methods onSessionManager. -
TCP and Unix transports propagate
ServerConfig— Per-connectionLineTransportRunnerinstances now receive the server config viawith_config(), enabling version-aware routing on connection-oriented transports. -
BYO Axum router (
into_axum_router) gains version tracking —AppStatenow carriesconfig,session_manager, andsession_versionsmap. Thehandle_json_rpchandler extractsmcp-session-idheaders and performs per-session versioned routing.
Removed
- CI performance benchmarks workflow — Removed standalone
performance.ymlworkflow and consolidated test infrastructure into a singletest.ymlworkflow.
Full Changelog: https://github.com/Epistates/turbomcp/compare/v3.0.8...v3.0.10
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]