---
summary: "Gate experimental `tasks` capability on actual task-tool registration — clients pinned to MCP spec 2025-06-18 strict-parse and fail on the unknown key. Add `notifyPromptListChanged`/`notifyToolListChanged` to `Context`. OTel semconv `^1.40 → ^1.41` (stable `deployment.environment.name`). Pin `fast-xml-parser` to `5.7.3`."
breaking: false
security: false
---

# 0.9.1 — 2026-05-15

## Added

- **`Context.notifyPromptListChanged?: () => void`** and **`Context.notifyToolListChanged?: () => void`** — new optional notifiers alongside the existing `notifyResourceListChanged` / `notifyResourceUpdated`. Wired through `ContextDeps`, the resource/tool registry notifier bundles (`HandlerNotifiers`, `ResourceHandlerNotifiers`), and `MockContextOptions` for tests. Handlers can now signal that the prompt or tool list has changed via `server.sendPromptListChanged()` / `server.sendToolListChanged()`.

## Changed

- **`tasks` capability advertisement gated on actual usage.** New `McpServerDeps.advertiseTasks` flag; `composeServices` sets it by scanning tools for `isTaskToolDefinition` or `def.task === true`. Servers without task tools no longer advertise the experimental SEP-1686 capability — fixes strict-parsing clients pinned to MCP spec `2025-06-18` that fail on the unknown key.
- **OTel `deployment.environment.name` uses the stable typed constant.** Migrated from string literal in `detectCloudResource` to `ATTR_DEPLOYMENT_ENVIRONMENT_NAME` from `@opentelemetry/semantic-conventions` `^1.41`, applied at resource construction site alongside `ATTR_SERVICE_NAME` / `ATTR_SERVICE_VERSION`. No attribute name change — same `deployment.environment.name` on the wire.
- **`scripts/devcheck.ts` `bun outdated` parser fixed.** `bun outdated` emits markdown-style rows (`| pkg | … |`) with an empty leading cell, so `split('|')[0]` was always empty and the allowlist never matched. Now reads index `[1]` and strips the trailing `(dev|peer|prod|optional)` workspace marker so bare package names match the allowlist.
- **`fast-xml-parser` pinned to exact `5.7.3`** across `peerDependencies` (was `latest`), `devDependencies` (was `^5.7.3`), and `resolutions`. Added to `devcheck.config.json` `outdated.allowlist`. Defensive ahead of `5.8.0`'s DOCTYPE entity validation, strnum `2.3.0` octal/binary parsing, and `fast-xml-builder` `1.2.0` tag-name sanitization shifts.
- **OTel dependency refresh:**
  - `@opentelemetry/exporter-metrics-otlp-http` `^0.217.0 → ^0.218.0`
  - `@opentelemetry/exporter-trace-otlp-http` `^0.217.0 → ^0.218.0`
  - `@opentelemetry/instrumentation-http` `^0.217.0 → ^0.218.0`
  - `@opentelemetry/instrumentation-pino` `^0.63.0 → ^0.64.0`
  - `@opentelemetry/sdk-node` `^0.217.0 → ^0.218.0`
  - `@opentelemetry/semantic-conventions` `^1.40.0 → ^1.41.1`
- **Resolution refresh** (transitive pins):
  - `brace-expansion` `1.1.14 → 5.0.6`
  - `picomatch` `2.3.2 → 4.0.4`
  - `protobufjs` `7.5.5 → 8.3.0`
  - `yaml` `1.10.3 → 2.9.0`
- **Other dev dependency bumps:**
  - `@cloudflare/vitest-pool-workers` `^0.16.3 → ^0.16.6`
  - `@cloudflare/workers-types` `^4.20260511.1 → ^4.20260515.1`
  - `@types/bun` `^1.3.13 → ^1.3.14`
  - `@types/node` `^25.6.2 → ^25.8.0`
  - `bun-types` `^1.3.13 → ^1.3.14`
  - `fast-check` `^4.7.0 → ^4.8.0`
  - `sanitize-html` `^2.17.3 → ^2.17.4`
  - `vite` `8.0.12 → 8.0.13`
- **Skill bump:** `api-workers` `1.3 → 1.4` — documents the `instructions` resolver form on `WorkerHandlerOptions` (runs inside `initializeApp(env)` after `injectEnvVars`).
- **README** — adds an `instructions` example to the `createApp()` snippet and a Features bullet covering server-level orientation.
