chore(deps): bump wordpress/mcp-adapter from 0.4.1 to 0.5.0

[dependabot]

Bumps wordpress/mcp-adapter from 0.4.1 to 0.5.0.

Release notes

Sourced from wordpress/mcp-adapter's releases.

v0.5.0

Highlights

v0.5.0 is a major internal upgrade for MCP Adapter. The biggest change is the adoption of wordpress/php-mcp-schema across the plugin, so MCP responses now use typed protocol DTOs instead of hand-built arrays.

This gives us a more consistent and spec-aligned foundation for tools, resources, prompts, initialization, and error responses, while making future MCP spec updates easier to support.

For most users, this should be a seamless upgrade. Existing ability registration, create_server(), and WordPress hooks continue to work as before. If you have custom handlers, transports, or code that depends on internal component structures, review the migration guide for upgrade details.

Included in this release

• Full integration of wordpress/php-mcp-schema throughout the adapter
• Typed DTO-based handling for MCP tools, resources, prompts, initialization, and JSON-RPC errors
• Protocol version negotiation support for 2025-11-25, 2025-06-18, and 2024-11-05
• Validation, encapsulation, and type-safety improvements across the core and domain layers
• Security hardening with stricter input validation and fail-closed permission handling
• Better observability for protocol errors and isError tool responses
• Reduced SessionManager write amplification to lower lock contention
• Packaging and dependency updates, including the php-mcp-schema v0.1.1 follow-up for cleaner Composer dist archives

Documentation

Documentation was expanded significantly for this release, including:

• A new v0.5.0 migration guide
• Updated architecture documentation
• Improvements to the default server guide and troubleshooting docs
• README updates, including WordPress 6.9/7.0 notes
• Additional guidance for ability registration

Contributors

• @​galatanovidiu
• @​jonathanbossenger
• @​JasonTheAdams
• @​spenserhale
• @​karthikeya-io
• @​itsgajendraSingh

New Contributors

• @​spenserhale made their first contribution in WordPress/mcp-adapter#44
• @​karthikeya-io made their first contribution in WordPress/mcp-adapter#169
• @​itsgajendraSingh made their first contribution in WordPress/mcp-adapter#165

Full Changelog: WordPress/mcp-adapter@v0.4.1...v0.5.0

Commits

• 7bfc49f Update README.md for WordPress 6.9/7.0 changes (#165)
• a6d8125 Add category to ability registration in README (#169)
• e8b5539 Bump wordpress/php-mcp-schema to v0.1.1 (#170)
• 8d0f1ef Replace since n.e.x.t placeholders with 0.5.0 (#167)
• f1c3566 Fix SessionManager write amplification causing lock contention (#166)
• 912c0ba Fix observability gap: isError tool responses and protocol errors lack contex...
• 33659df fix: Revert property visibility changes that broke backward compatibility (#159)
• e140c18 Encapsulation and type safety improvements (#154)
• da6d892 Security hardening: input validation and fail-closed permissions (#153)
• b7a139c Fix PHPDoc inconsistencies and remove duplicate code (#155)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)