Repository navigation
Release v1.0.0 #5080
Description
Activity
- linked a pull request that will close this issuechore: v1.0.0 release audit, dependency fixes #5082
on Oct 10, 2026 Audit report (step 2a)
Run on
origin/v2/mainat1a9554d1:npm audit(root lockfile, all four workspaces) andpip-audit --require-hashesoveruv export --frozenfor each Python server. Every Python server returned a verdict (EXIT=0).Found: npm 15 (1 critical, 9 high, 5 moderate); Python fetch 22 in 5 packages, git 40 in 3, time 16 in 2.
Outcomes (decided by @cliffhall): every finding with a fix inside its declared range is fixed in #5082, one commit per package.
Outcome Packages Fixed, npm runtime ( overrides)proxy-addr 2.0.8 (critical), ip-address 10.7.3, brace-expansion 5.0.12, hono 4.13.13, qs 6.16.0 Fixed, npm dev nanoid 3.3.20, source-map-js 1.2.2, vitest / @vitest/coverage-v8 ^4.1.11 (lockstep) Fixed, Python floor + lock gitpython ≥3.1.60 (git), protego ≥0.6.2 (fetch) Fixed, Python lock cryptography 50.0.2, pyjwt 2.15.1 (all three), urllib3 2.8.0, soupsieve 2.10 (fetch) No fix available npm braces(GHSA-vfj7-8cjw-p6xm, high): no patched release. Dev only, throughshx; not reachable from a published serverNone needed a major.
After #5082:
npm auditreports onlybraces, andpip-auditreports "No known vulnerabilities found" for fetch, git and time (pyjwt PYSEC-2026-4146, which had no listed fix version, also clears at 2.15.1).- linked a pull request that will close this issuechore: fold pending changesets into a 1.0.0 CHANGELOG for each TypeScript server #5083
on Oct 10, 2026 - linked a pull request that will close this issuechore: stamp Python CalVer versions for 2026.10.10 #5084
on Oct 10, 2026 Change of plan: v1.0.0 is cut from before the SDK v2 migration
Maintainer decision (@cliffhall): v1.0.0 releases the legacy-era servers on SDK 1.x, from
d8120439(the lastv2/maincommit before #5063), plus cherry-picks of #5077 (#5060) and #5078 (#5076). The SDK v2 migration (#4856, #4851) moves to 2.0.0, where its breaking changes (Node 20 floor,-32602for unknown tools, 2020-12 schemas) belong.Because
v2/mainis already past that commit, this release uses a one-time release branch,v2/release/1.0.0(cut atd8120439), as an exception to the flow in thereleaseskill:- Preparation PRs target
v2/release/1.0.0: the cherry-picks, a fresh audit (its lockfile is SDK 1.x), the changeset fold into a1.0.0CHANGELOG (no SDK v2 entries), the Python CalVer stamp. - The merge PR is
v2/release/1.0.0→main. Release v1.0.0: merge v2/main into main #5085 (v2/main→main) is closed unmerged. - The ledger is re-run against that tree.
- After publishing,
v2/mainis reconciled once: the four*-sdk-v2.mdmajor changesets restored, the CHANGELOGs aligned with what shipped, andv2/release/1.0.0merged intov2/main, so the next milestone merge is clean.
#5082/#5083/#5084 stay on
v2/main(they apply to the SDK v2 tree) and are reconciled in step 4. The first audit report above was run on the post-migration tree; a new one follows for this tree.- Preparation PRs target
- linked a pull request that will close this issuev1.0.0: cherry-pick #5077 and #5078 onto the release branch #5086
on Oct 10, 2026 - linked a pull request that will close this issuev1.0.0: release audit for the SDK 1.x release branch #5087
on Oct 10, 2026 Audit report for the release branch (step 2a, SDK 1.x tree)
Run on
v2/release/1.0.0atd8120439, same method as the report above. Every Python server returned a verdict.Found: npm 17 (1 critical, 11 high, 5 moderate); Python fetch 24, git 42, time 18.
Outcomes (maintainer: fix everything in range), in the release-branch audit PR:
Outcome Packages Same as #5082 proxy-addr, ip-address, brace-expansion, hono, qs, nanoid, source-map-js, vitest; gitpython, protego, cryptography, pyjwt, urllib3, soupsieve New on this tree @modelcontextprotocol/sdkGHSA-6qxp-vccf-f47h (OAuth client, not used by these servers): floor^1.30.0→^1.31.0, patch changeset per server;fast-uri3.1.8 (override);anyio4.15.1 (lock)No fix available npm braces(dev only, viashx)After:
npm auditreports onlybraces;pip-auditclean for fetch, git and time.- linked a pull request that will close this issuev1.0.0: fold pending changesets into a 1.0.0 CHANGELOG (release branch) #5088
on Oct 10, 2026 - linked a pull request that will close this issuev1.0.0: stamp Python CalVer versions for 2026.10.10 (release branch) #5089
on Oct 10, 2026 - added a commit that references this issue
on Oct 10, 2026 Published
Release v1.0.0, tag
v1.0.0at the merge commitc003d0d8(tree7b843d76, the tree the release ledger verified).release.ymlrun 38105912909: 15/15 jobs succeeded.Package Version Registry Check @modelcontextprotocol/server-everything1.0.0 npm latest, SLSA provenance@modelcontextprotocol/server-filesystem1.0.0 npm latest, SLSA provenance@modelcontextprotocol/server-memory1.0.0 npm latest, SLSA provenance@modelcontextprotocol/server-sequential-thinking1.0.0 npm latest, SLSA provenancemcp-server-fetch2026.10.10 PyPI latest mcp-server-git2026.10.10 PyPI latest mcp-server-time2026.10.10 PyPI latest Remaining, tracked on #4968: the one-time
npm deprecateof the date-stamped versions (pre-check passes:latestis 1.0.0 on all four,2026.8.31not yet deprecated), and reconcilingv2/mainwithv2/release/1.0.0.
The release issue for milestone v1.0.0, cut through the
releaseskill. Every preparation PR and the merge PR reference it; it stays open until the GitHub Release is published.Part of #4968, which carries the scope and the post-release steps (the
npm deprecateof the date-stamped versions).Steps
npm audit,pip-auditper Python server); report posted here1.0.0: fold the pending changesets into a1.0.0CHANGELOG entry per server and delete them (per First semver release: TypeScript servers at 1.0.0 and Python servers at the next CalVer, the frozen legacy-era servers #4968, instead of merging Version Packages chore: version packages #4941, which would bump to2.0.0)v2/main→main(Part of #N);git merge-treemust yieldorigin/v2/main's treelocal:gate,pack:verify, every closed milestone issue exercisedreleaseenvironmentKnown blocker for step 3
git merge-tree --write-tree origin/main origin/v2/mainconflicts inCONTRIBUTING.md: the contribution-policy sync commits onmain(#4939 and follow-ups) hold an older copy thanv2/main's (which added the coverage-gate wording in1cdd4a70). It is the only main-side change that differs fromv2/main.