chore: 2.0.0 - #1842
Merged
Merged
Conversation
The v2 go-live release (#1818, phase 5 of #1804). This is byte-identical to 2.0.0-rc.3 apart from dropping the prerelease suffix, which is what makes rc.3's validation meaningful: the tree that ships is the tree that was validated against the live registry. `2.0.0` has no hyphen, so the derivation added in #1834 resolves it to `latest` — this is the release that takes the tag from 1.0.1. Validated across three release candidates: - rc.1 caught two publish-path defects invisible to every local check — `NODE_AUTH_TOKEN` pointing at a non-existent secret (shadowing OIDC trusted publishing) and a missing npm CLI upgrade (trusted publishing needs >= 11.5.1; Node 22 bundles 10.x). Both fixed in #1836. - rc.2 validated the dependency sweep (#1837) that cleared every prod-scope advisory using lockfile-only changes. - rc.3 validated the vite 8.1.5 bump (#1841) closing three high-severity dev-server file-read advisories. Each RC was verified with a cold `node:22` container install driving the published tarball end to end — install, `--help`, and a real `--cli tools/list` against a live stdio server. `latest` remained on 1.0.1 throughout, proving the `--tag` derivation. Zero open Dependabot alerts at time of release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v2 go-live release — phase 5 of #1804, closing #1818.
Merging this publishes nothing. The npm publish happens when the⚠️ That step is irreversible.
2.0.0GitHub release is cut against the merged commit.The diff
Two files, version only:
Byte-identical to
2.0.0-rc.3apart from dropping the prerelease suffix. That is the whole point: the tree that ships is the tree that was validated against the live registry.2.0.0has no hyphen, so #1834's derivation resolves it tolatest— this is the release that takes the tag from 1.0.1.What the three RCs established
NODE_AUTH_TOKENpointing at a non-existent secret (shadowing OIDC), and a missing npm CLI upgrade (trusted publishing needs ≥11.5.1; Node 22 bundles 10.x). Fixed in #1836.Each was verified with a cold
node:22container driving the published tarball end to end — install,--help, and a real--cli tools/listagainst a live stdio server.lateststayed on 1.0.1 through all three, which is what proves the--tagderivation works.State at release time
latestv1-latestv1/mainv1-latestRollback
Written and verified before any publish — see the plan on #1818. npm unpublish is not available in practice; recovery is dist-tag surgery (
npm dist-tag add @modelcontextprotocol/inspector@1.0.1 latest, deprecate the bad version, ship 2.0.1). npm rights confirmed for the release cutter plus four other maintainers.🤖 Generated with Claude Code
https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD