From 494f43d3a79a34c3e99f4293a75d5885376406d1 Mon Sep 17 00:00:00 2001
From: Koichi ITO <koic.ito@gmail.com>
Date: Tue, 7 Jul 2026 22:16:05 +0900
Subject: [PATCH] Release 0.23.0

New features and changes have landed, making it a good time to cut a release.
Further feature proposals can be incorporated in future releases.
---
 CHANGELOG.md       | 18 ++++++++++++++++++
 lib/mcp/version.rb |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7cff0c26..78d8144b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-07-07
+
+### Added
+
+- Add a session-ownership hook to `StreamableHTTPTransport`
+
+### Changed
+
+- Require calling `MCP::Client#connect` before sending requests on stdio transport (#427)
+
 ### Deprecated
 
 - Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)
 
+### Fixed
+
+- Fix an incorrect `result: null` response to an id-bearing notification message (#435)
+- Validate `Host` and `Origin` headers to prevent DNS rebinding per MCP 2025-11-25
+- Bound stateful session retention to prevent an initialize-flood DoS
+- Bound stdio frame reads with `max_line_bytes`
+- Bound request body and frame reads to prevent memory-exhaustion DoS
+
 ## [0.22.0] - 2026-06-27
 
 ### Added
diff --git a/lib/mcp/version.rb b/lib/mcp/version.rb
index d0fe33fa..0e2618f8 100644
--- a/lib/mcp/version.rb
+++ b/lib/mcp/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MCP
-  VERSION = "0.22.0"
+  VERSION = "0.23.0"
 end