Release v2.0.0 #5159

Activity

1. cliffhall

   added this to the v2.0.0 milestone on Oct 18, 2026
2. cliffhall

   added

   v2

   choreMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior changeMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior change

   on Oct 18, 2026
3. cliffhall

   self-assigned this

   on Oct 18, 2026
4. cliffhall commented on Oct 18, 2026

   

   cliffhall

   on Oct 18, 2026

   MemberAuthor

   More actions

   2a. Audit report (v2.0.0)

   Run against origin/v2/main at 38569bd5, 2026-10-18.

   Python (pip-audit over each server's locked requirements)

   Server	Result
   fetch	No known vulnerabilities found
   git	No known vulnerabilities found
   time	No known vulnerabilities found

   All three audited (EXIT=0).

   npm (npm audit --audit-level=high)

   5 high-severity entries, all one advisory: braces GHSA-vfj7-8cjw-p6xm (stack-exhaustion DoS through deeply nested patterns), reached through shx → shelljs → fast-glob → micromatch → braces.

   Outcome: no fix available, and not reachable from the servers.

   • No fix: the advisory covers braces <= 3.0.3 and has no patched version. npm audit offers npm audit fix --force, which would downgrade shx to 0.3.4. That is the silent downgrade AGENTS.md Dependencies rules out, so it was not applied.
   • Not reachable: shx is a devDependency in all four TypeScript workspaces, used only by their build scripts on fixed globs the repository controls. npm audit --omit=dev --audit-level=high reports 0 vulnerabilities, so nothing that publishes carries braces.

   No fixes were forced, so there is no audit PR; this comment is the record.
5. cliffhall

   linked a pull request that will close this issuechore: version packages #5100on Oct 18, 2026
6. cliffhall commented on Oct 18, 2026

   

   cliffhall

   on Oct 18, 2026

   MemberAuthor

   More actions

   2b. Version Packages: #5100 merged (4be9e989)

   All four TypeScript servers at 2.0.0: major for the SDK v2 move, minor for the 2026-07-28 revision, plus a patch for sequential-thinking (#5108). Nine changesets consumed; package-lock.json records 2.0.0 for each.

   Before merging, #5163 (#5161) set the changesets template so the CHANGELOG lines read [@author] rather than Thanks [@author]!; #5100 was regenerated from it. CI green on its head 41752e32.

   #5100 is linked to this issue with addCloseIssueReferences and its body starts Part of #5159. It closes nothing: this issue stays open until the Release is published.
7. cliffhall

   linked a pull request that will close this issuechore: stamp Python CalVer versions for 2026.10.18 #5165on Oct 18, 2026
8. cliffhall

   linked a pull request that will close this issueRelease v2.0.0: merge v2/main into main #5166on Oct 18, 2026
9. cliffhall

   linked a pull request that will close this issuechore: stamp Python CalVer versions for 2026.10.19 #5177on Oct 19, 2026
10. cliffhall

    closed this as completedin #5166on Oct 19, 2026
11. cliffhall commented on Oct 19, 2026

    

    cliffhall

    on Oct 19, 2026

    MemberAuthor

    More actions

    v2.0.0 is published: https://github.com/modelcontextprotocol/servers/releases/tag/v2.0.0 (tag v2.0.0 at 51b6382a, the merge commit of #5166, tree 717fcff7 as verified in the release ledger).

    release.yml run 39211896874: all 7 build jobs and all 7 publish jobs succeeded.

    • npm: @modelcontextprotocol/server-everything, -filesystem, -memory, -sequential-thinking at 2.0.0, on latest, engines.node >=24, with provenance.
    • PyPI: mcp-server-fetch, mcp-server-git, mcp-server-time at 2026.10.19, requiring mcp>=2.3,<3.
    • CodeQL alerts Minor README nits #25, Fix SQLite server logging to file #28, Fetch URL Server #29, README Cleanup #30 on main: fixed by the merge.

    Filed for v2.1.0 during this release: #5160, #5162, #5164, #5167, #5170, #5173, #5176.
12. timothybrush

    added a commit that references this issue on Oct 19, 2026

    chore: stamp Python CalVer versions for 2026.10.18

    ...

    38fdee2