chore(deps): bump the php-production group with 3 updates

[dependabot]

Bumps the php-production group with 3 updates: nesbot/carbon, knplabs/knp-components and mcp/sdk.

Updates nesbot/carbon from 3.13.1 to 3.13.2

Release notes

Sourced from nesbot/carbon's releases.

3.13.2

What's Changed

• Prioritize day names over month names when translating string before the first number occurs in the string by @​kylekatarnls in CarbonPHP/carbon#139

Full Changelog: CarbonPHP/carbon@3.13.1...3.13.2

Commits

• a1c5491 Merge pull request #139 from CarbonPHP/feature/issue-138-day-and-month-transl...
• f5e32b7 Drop mmm_suffix
• f0a2405 Prioritize day names over month names when translating string before the firs...
• d81c9c4 Merge pull request #3352 from briannesbitt/dependabot/github_actions/pnpm/act...
• dd3e1ca Bump pnpm/action-setup from 6 to 6.0.9
• 7d6a63e Merge pull request #3351 from briannesbitt/job/update-sponsors
• fa2f48f Update sponsors
• 7260075 Merge pull request #3350 from briannesbitt/dependabot/github_actions/actions/...
• 2536c74 Bump actions/setup-node from 6 to 7
• 07c578d Merge pull request #3348 from briannesbitt/job/update-sponsors
• Additional commits viewable in compare view

Updates knplabs/knp-components from 5.2.0 to 5.3.0

Release notes

Sourced from knplabs/knp-components's releases.

v5.3.0

What's Changed

• feat: fixes errors on complex where statements and tests required by @​shakaran in KnpLabs/knp-components#349
• drop support for PHP 8.1 by @​garak in KnpLabs/knp-components#353

New Contributors

• @​shakaran made their first contribution in KnpLabs/knp-components#349

Full Changelog: KnpLabs/knp-components@v5.2.0...v5.3.0

Commits

• 1c69651 Merge pull request #353 from garak/drop-php81
• 4a6f3d8 drop support for PHP 8.1
• bb8e028 feat: fixes errors on complex where statements and tests required (#349)
• See full diff in compare view

Updates mcp/sdk from 0.7.0 to 0.7.1

Release notes

Sourced from mcp/sdk's releases.

v0.7.1

What's Changed

• Hardening transports
• Fix codestyle pipeline on main by @​chr-hertel in modelcontextprotocol/php-sdk#402
• Fix 'notifcation' typo in docs by @​latent-9 in modelcontextprotocol/php-sdk#410

New Contributors

• @​latent-9 made their first contribution in modelcontextprotocol/php-sdk#410

Full Changelog: modelcontextprotocol/php-sdk@v0.7.0...v0.7.1

Changelog

Sourced from mcp/sdk's changelog.

Changelog

All notable changes to mcp/sdk will be documented in this file.

0.8.0

• Always emit {} for empty tool schemas: Tool recursively normalizes every empty sub-schema — properties, items, additionalProperties, $defs, combinators and the other draft-07 to 2020-12 schema keywords — in the constructor, for both inputSchema and outputSchema, so an object position is never serialized as [].
• Prompt generators returning content as typed arrays (['type' => 'text', ...] etc.) no longer lose the optional fields: annotations on every content type, and _meta and an explicit mimeType on embedded resource contents, now carry through to the resulting PromptMessage instead of being silently dropped. A missing resource mimeType still defaults to text/plain/application/octet-stream as before.
• Add annotations support to ImageContent (constructor, fromArray(), fromFile(), fromString(), jsonSerialize()), matching TextContent and AudioContent.
• Add client-side roots/list handler (ListRootsRequestHandler + RootsCallbackInterface) and Client::sendRootsListChanged(), plus server-side ClientGateway::listRoots() / supportsRoots() and ListRootsResult::fromArray().
• Add ClientGateway::supportsSampling(), so a tool can check the client's advertised capabilities before issuing a sampling/createMessage request instead of asking and catching the refusal. Matches the existing supportsRoots() and supportsElicitation().
• [BC Break] Gate structuredContent on the negotiated protocol revision: ToolReference::extractStructuredContent() takes an optional ProtocolVersion and, for revisions predating SEP-2106 (2025-11-25 and earlier, where structuredContent must be a JSON object), returns null for a tool result that is a PHP list or an object serializing to a JSON array. From 2026-07-28 on both are emitted as-is. Objects serializing to a scalar and arrays holding Content instances are never emitted, in any revision. CallToolHandler resolves the revision from the request's _meta (modern era) or the session (handshake era) and falls back to the strictest rule; it logs a warning when a tool declares an outputSchema but returns a value that cannot be sent, and when a self-built CallToolResult carries a structuredContent the revision does not allow (that one is passed through unchanged). Tools returning a list against an older client keep their JSON-encoded value in content; they just no longer advertise an invalid structuredContent.
• Add Mcp\Schema\Content\ResourceLink for the spec's resource_link content block (protocol revision 2025-06-18+), letting tool results and prompt messages reference a resource by URI/name without embedding its contents. Accepted anywhere resource (EmbeddedResource) content is (de)serialized: CallToolResult::fromArray(), PromptMessage::fromArray(), and PromptResultFormatter.
• Negotiate the protocol revision during the initialize handshake: the server echoes a revision it supports and counter-offers ProtocolVersion::latestHandshake() otherwise (Builder::setProtocolVersion() pins it to exactly one), and the client fails the handshake on a counter-offer it cannot speak rather than continuing on an unagreed revision. Adds Client::getProtocolVersion(), the 2026-07-28 revision, and the era helpers on ProtocolVersion — revisions from 2026-07-28 on have no initialize, so they are excluded from negotiation and from ProtocolVersionMiddleware's default supported set.
• Add sampling with tools support: sampling requests now accept tools and tool-choice preferences, messages support tool-use/tool-result content blocks and multiple content blocks, and clients can advertise the sampling.context and sampling.tools capabilities. Adds ClientGateway::supportsSamplingTools() / supportsSamplingContext() to check the sub-capabilities before sending, and CreateSamplingMessageRequest::validateToolFlow(), which asserts the spec's tool-flow rules across the whole message list — the client handler rejects a violating request with -32602 instead of leaving it unanswered, and the gateway refuses to send one.
• [BC Break] SamplingMessage::$content and CreateSamplingMessageResult::$content may now hold a list of content blocks instead of a single one, so code reading them directly must handle both. Use the new getContentBlocks() on either class to always get a list.
• [BC Break] CreateSamplingMessageResult now rejects any role other than assistant, and rejects empty content, as the specification requires.

Commits

• 785fc3b Fix 'notifcation' typo in docs (#410)
• 9a6d24c Fix codestyle pipeline for 0.7.1 (#402)
• 9aa18f3 Merge commit from fork
• 529099f Merge commit from fork
• 055593f Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions