fix(core): merge request headers case-insensitively

[uczltw6]

Summary

• Merge per-request headers over base RequestInit headers case-insensitively.
• Preserve unrelated base headers and the caller's header spelling.
• Add a regression test for differently cased Authorization overrides and a patch changeset for the affected packages.

Root cause

createFetchWithInit() merged normalized header objects with object spread. HTTP field names are case-insensitive, but JavaScript object keys are not. A base Authorization: Bearer base-token and a per-request authorization: Bearer request-token therefore both survived the merge; constructing the final Headers combined them into the invalid value Bearer base-token, Bearer request-token.

The client Streamable HTTP and legacy SSE transports both use this helper to combine caller-provided requestInit with SDK request headers, so request-specific credentials must replace the base header regardless of casing.

Validation

• Regression test failed before the fix with the combined credential and passes after the fix.
• @modelcontextprotocol/core-internal: 69 test files, 1448 tests passed.
• Client auth tests: 259 passed.
• Streamable HTTP custom-header tests: 3 passed.
• SSE custom-header tests: 4 passed.
• Repository pre-push gate passed in full: Build, Typecheck, and Lint.

AI assistance disclosure: OpenAI Codex helped identify the header-merge edge case and prepare the focused implementation and test. The production call paths, behavior, and test results were verified locally.

[changeset-bot]

🦋 Changeset detected

Latest commit: a10cb78

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/core-internal	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2687

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2687

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2687

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2687

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2687

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2687

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2687

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2687

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2687

commit: a10cb78