Repository navigation
Release v2.1.0 #5243
Description
Release the v2.1.0 milestone: v2/main → main, then publish, per the release skill.
- Milestone complete (only this issue open)
- 2a audit (report as a comment here; PR only if fixes are forced)
- 2b Version Packages PR (chore: version packages #5242) linked, CI green, merged
- 2c Prepare Python Release PR merged
- 3 merge PR
v2/main→main(Part of), merge-tree matchesorigin/v2/main - 4
local:gate,pack:verify, every closed milestone issue exercised; release ledger published - 5 draft release notes; maintainer publishes and approves
releasedeployments - 6 registries verified; card Done; worktrees removed
Activity
cliffhall commentedon Oct 24, 2026
Release audit: v2.1.0
Audited
origin/v2/mainat56e4c4e2(after #5244 and #5245 merged), per thereleaseskill step 2a:npm audit --audit-level=highover the root lockfile, andpip-audit --require-hashesover each Python server's exporteduv.lock. Every Python server produced a verdict (EXIT=0).Findings and outcomes
Every finding had a fix inside the ranges already declared, so none needed a major or a release-day manifest change beyond the lines below. Each fix is its own commit.
zod4.4.3^4.2.0admits it)body-parser2.3.0expressineverythingeverything's HTTP transportsip-address10.7.3express-rate-limitviaserver-legacyineverythingeverything's HTTP transports^10.7.1→^10.7.4undici6.29.0, 8.11.2mcp-server-diff(interface diff)fast-uri3.1.8ajvviamcp-server-diff^3.1.8→^3.1.9launch-editor2.14.1@changesets/clivitest/@vitest/mocker/@vitest/coverage-v84.1.11^4.1.11→^4.1.12in all four workspaces, in lockstep (the two pin each other exactly, sonpm updatecannot move either alone)gitpython3.2.0 (src/git)mcp-server-gitgituv.lock→ 3.2.1 (declared>=3.1.60admits it)fetchandtime: no known vulnerabilities (fetchincludes the certifi fix from #5244).After the fixes:
npm auditreports 0 vulnerabilities;verify:dep-locksteppasses.One test followed the zod refresh. zod 4.6 writes a union of primitive types as
type: ["boolean", "string"]instead ofanyOf: [{type: "boolean"}, {type: "string"}]. The two are equivalent JSON Schema.sequentialthinking'stools/listtest pinned the old form, so its expectation is updated in its own commit. This is not a new interface change: a fresh install of the published server already resolves zod 4.6, so clients already see this form. Only the checkout's lockfile was behind.Changesets
None. No TypeScript server's runtime manifest changed: the runtime fixes are lockfile refreshes and root
overrides, which a published package does not carry, and the declared ranges already admit the patched versions, so a fresh install of any published server resolves them. Thevitestrange bump is a devDependency. If the maintainers want installed trees with an oldzodforced forward, raising each server'szodfloor to^4.6.6would need a patch changeset; that was not done here.npm audit fixwas not used.Fixes: #5247
cliffhall commentedon Oct 25, 2026
Released: https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0 (tag on ef9808f, the commit the ledger verified). Published: @modelcontextprotocol/server-everything 2.0.1, @modelcontextprotocol/server-filesystem 2.0.1, mcp-server-fetch 2026.10.24; the other four were already on their registries. release.yml run 40145185033: every build and publish job succeeded.