Skip to content

Epistates/TurboMCP

v3.0.10 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 2mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mcp mcp-client mcp-sdk mcp-server mcp-servers rust

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Session-level protocol version tracking enforces MCP initialization lifecycle across all transports.

Full changelog

[3.0.10] - 2026-03-26

Fixed

  • 3.0.9 publish was missing changes — Re-publish includes all session-level version tracking, ServerBuilder::with_protocol(), ProtocolConfig prelude re-export, stdio::run_with_config(), SessionState lifecycle enforcement, and versioned routing across all transports.

Added

  • Session-level protocol version tracking across all transports — Every transport (STDIO, HTTP, TCP, Unix, WebSocket) now stores the negotiated ProtocolVersion after a successful initialize handshake and routes all subsequent requests through route_request_versioned, applying the correct version adapter for response filtering. Previously, version-aware routing was only available at the protocol layer; transports bypassed it.

  • MCP initialization lifecycle enforcementSessionState enum (Uninitialized / Initialized(ProtocolVersion)) enforces the MCP spec requirement that initialize must succeed before any other method is accepted. Pre-init requests are rejected with a clear error. Duplicate initialize requests are rejected. Lifecycle notifications (notifications/initialized, notifications/cancelled) pass through unconditionally.

  • ServerBuilder::with_protocol() — New builder method to configure protocol version negotiation (e.g., ProtocolConfig::multi_version()) through the high-level builder API.

  • ProtocolConfig re-exported from preludeturbomcp::prelude::ProtocolConfig is now available for ergonomic multi-version server setup.

  • stdio::run_with_config() — New entry point for STDIO transport that accepts ServerConfig, enabling multi-version protocol support for STDIO-based servers.

  • 3 new transport-layer teststest_line_transport_ping_after_init (verifies requests succeed after init), test_line_transport_rejects_before_init (verifies pre-init rejection), test_line_transport_rejects_duplicate_init (verifies duplicate init rejection).

Changed

  • adapter_for_version() returns &'static dyn VersionAdapter — Replaced Box<dyn VersionAdapter> with static references to zero-sized adapter instances, eliminating per-request heap allocation.

  • HTTP SessionManager stores per-session protocol versionSessionData struct replaces bare broadcast::Sender, bundling the SSE channel with an optional ProtocolVersion. New set_protocol_version() / get_protocol_version() methods on SessionManager.

  • TCP and Unix transports propagate ServerConfig — Per-connection LineTransportRunner instances now receive the server config via with_config(), enabling version-aware routing on connection-oriented transports.

  • BYO Axum router (into_axum_router) gains version trackingAppState now carries config, session_manager, and session_versions map. The handle_json_rpc handler extracts mcp-session-id headers and performs per-session versioned routing.

Removed

  • CI performance benchmarks workflow — Removed standalone performance.yml workflow and consolidated test infrastructure into a single test.yml workflow.

Full Changelog: https://github.com/Epistates/turbomcp/compare/v3.0.8...v3.0.10

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Epistates/TurboMCP

Get notified when new releases ship.

Sign up free

About Epistates/TurboMCP

TurboMCP SDK: Enterprise MCP SDK in Rust

All releases →

Beta — feedback welcome: [email protected]