No refuge in the old line
The 1.x line got the same four defaults the same afternoon
Version 1.30.0 of the Python SDK shipped at 14:03 on 7 September, an hour and fifty minutes before 2.2.0, with the same four behaviour changes. The project describes the 1.x line as maintenance only. Redirects are origin-bound, idle sessions close at thirty minutes, the session cap is 10,000 where there was none, and the OAuth client rejects a mismatched issuer.
The one difference is the error type: a refused redirect on 1.x fails with httpx.HTTPStatusError rather than MCPError, so code that catches one will miss the other. Staying on 1.x to keep the old behaviour therefore means pinning below 1.30.0, and the 1.x documentation now lives under a /v1/ path. The paper’s recommendation is not to pin: take the change on whichever line you run and fix what breaks, because the old behaviour is the vulnerability.
What it changes Pinning to the 1.x line does not avoid the change; only pinning below 1.30.0 does, on a line the project has stopped developing, and the paper’s advice is to take the change instead.
Primary source read