chore(release): merge v2/main into main for v2.9.0 - #2536

Merged

cliffhall merged 187 commits into

mainfrom

v2/chore/milestone-merge-v2.9.0

Sep 30, 2026

Commits on Sep 24, 2026

Commits on Sep 25, 2026

fix(auth): compensate partial keychain purges; move sections descriptor to POST body

BobDickinson
and
Copilot
committed
6f70aec
fix(auth): compensate a partially-committed keychain delete in deleteClientConfigStore

BobDickinson
and
Copilot
committed
39d548c
fix(auth): lock OAuth reads against torn residue/secret joins; keep lock errors 503

BobDickinson
and
Copilot
committed
5178060
fix(auth): handle __proto__ keys in persistence maps (prototype-pollution class)

BobDickinson
and
Copilot
committed
a2ba182
fix(auth): round-13 polish — accurate migration warning, strict write-body keys, deterministic settle tests

BobDickinson
and
Copilot
committed
92b6620
fix(auth): use own-property reads for untrusted map keys and reject prototype-name store ids

BobDickinson
and
Copilot
committed
f58b3d8
fix(auth): validate store values in migration, blob map shapes, and the issuer-slot rebuild

BobDickinson
and
Copilot
committed
d883fad
chore(scripts): fail fast when node_modules is older than its lockfile (#2494)

cliffhall
and
claude
committed
5281558
Merge pull request #2495 from modelcontextprotocol/v2/chore/2494-verify-install-fresh
cliffhall
authored
641765a
fix(auth): strict OAuth hydration, schema-matched stored-value validation, and an enumeration-checking keychain probe

BobDickinson
and
Copilot
committed
175eca2
fix(smoke): parse CLI error envelope from last stderr line

BobDickinson
and
Copilot
committed
d27a6a2
fix: refuse OAuth state mutations when oauth.json is unrecognized

BobDickinson
and
Copilot
committed
0785023
docs: add MCP Inspector: Our AI Software Factory
BobDickinson
committed
bc98594
docs: address Copilot review on #2498
BobDickinson
committed
0a942dd
fix: enforce a body-size cap on POST /api/storage/:storeId

BobDickinson
and
Copilot
committed
869de23

Commits on Sep 26, 2026

fix: split registration_access_token into the secret store

BobDickinson
and
Copilot
committed
581e387
fix(cli): surface secret-store failures instead of reporting no_stored_token

BobDickinson
and
Copilot
committed
6ebb203
fix(cli): bound the OAuth browser open and say when it fails (#2410)

cliffhall
and
claude
committed
bf7b395
chore(tui): justify every exhaustive-deps suppression (#2414)

cliffhall
and
claude
committed
aeba2ec
test(launcher,cli): assert Windows backslash paths survive argv forwarding (#2416)

cliffhall
and
claude
committed
3094905
fix(scripts): fail the Dependabot sweep clearly on a bad alert listing (#2425)

cliffhall
and
claude
committed
483348c
fix(docker): derive the HEALTHCHECK probe address from HOST (#2424)

cliffhall
and
claude
committed
40184da
docs(cli): state the real purpose of the openUrl timeout (#2499 review)

cliffhall
and
claude
committed
f3e7c66
chore(smoke): surface the app's connect error on a connect timeout (#2496)

cliffhall
and
claude
committed
501ec1c
fix(scripts): reject a zero-page alert listing (#2502 review)

cliffhall
and
claude
committed
2d3e8da
fix(core): enforce one deadline per RequestInit in withOAuthRequestTimeout (#2418)

cliffhall
and
claude
committed
3186bc4
Merge pull request #2499 from modelcontextprotocol/v2/fix/2410-cli-open-url-fallback
cliffhall
authored
cba3f72
Merge branch 'v2/main' into v2/chore/2414-tui-exhaustive-deps-justify
cliffhall
authored
428bc04
Merge branch 'v2/main' into v2/chore/2418-request-deadlines-invariant
cliffhall
authored
c7f46c0
Merge branch 'v2/main' into v2/chore/2416-windows-path-argv
cliffhall
authored
61abd95
Merge branch 'v2/main' into v2/fix/2424-healthcheck-host
cliffhall
authored
757ad4e
fix(docker): trim CLIENT_PORT in the healthcheck probe as the server does (#2504 review)

cliffhall
and
claude
committed
8841ea9
Merge remote-tracking branch 'origin/v2/fix/2424-healthcheck-host' into v2/fix/2424-healthcheck-host
cliffhall
committed
8e92f7f
fix(server): drive rename secret copy from strict reads; name the right locked file

BobDickinson
and
Copilot
committed
b43a5eb
Merge pull request #2500 from modelcontextprotocol/v2/chore/2414-tui-exhaustive-deps-justify
cliffhall
authored
73bdb79
Merge pull request #2501 from modelcontextprotocol/v2/chore/2416-windows-path-argv
cliffhall
authored
bcaa42c
Merge pull request #2503 from modelcontextprotocol/v2/chore/2418-request-deadlines-invariant
cliffhall
authored
d1f1688
Merge pull request #2504 from modelcontextprotocol/v2/fix/2424-healthcheck-host
cliffhall
authored
b26b8fa
Merge pull request #2505 from modelcontextprotocol/v2/chore/2496-smoke-connect-diagnostics
cliffhall
authored
92c053f
fix(auth): pin the AES-GCM auth tag length in FileSecretStore

cliffhall
and
claude
committed
18f5623
ci: split the npm release job so install scripts never hold the OIDC token

cliffhall
and
claude
committed
99ba6eb
ci: update the workflow header for the package/publish split

cliffhall
and
claude
committed
b50ce03
Merge pull request #2502 from modelcontextprotocol/v2/fix/2425-dependabot-alerts-api-errors
cliffhall
authored
9427cea
test(auth): assert the GCM tag-length pin at cipher construction

cliffhall
and
claude
committed
21090ba
ci: refuse a tarball carrying publishConfig and pin the publish registry

cliffhall
and
claude
committed
b6278fd
fix(cli): classify auth errors by type, not message keywords; isolate smokes from host keychain

BobDickinson
and
Copilot
committed
c6baeba
ci: order release runs and re-assert the tarball's name and version

cliffhall
and
claude
committed
e044bcd
fix(docker): skip the web healthcheck probe under --cli/--tui (#2415)

cliffhall
and
claude
committed
c8aa0b2
ci: state the release concurrency group's actual guarantee

cliffhall
and
claude
committed
07ffa39
Merge pull request #2509 from modelcontextprotocol/v2/fix/2485-gcm-auth-tag-length
cliffhall
authored
e225600
fix(web): report the Inspector version as clientInfo.version

cliffhall
and
claude
committed
bbfa221
fix(docker): only recognize the launcher in the two real PID 1 shapes

cliffhall
and
claude
committed
6925180
Merge pull request #2506 from modelcontextprotocol/v2/chore/2483-split-release-publish
cliffhall
authored
30a9a89
fix(docker): require the node interpreter and keep empty argv entries

cliffhall
and
claude
committed
e35a0b0
SHA-pin the actions in credential-holding workflow jobs

cliffhall
and
claude
committed
51c7148
test: stop the useServers render loop and guard against its return

cliffhall
and
claude
committed
6d06abd
docs(auth): correct StoredOAuthClientInformation provenance comment

BobDickinson
and
Copilot
committed
fe3872c
Merge pull request #2511 from modelcontextprotocol/v2/fix/2445-web-client-version
cliffhall
authored
5e5b092
verify:action-pins: catch every secret spelling and reusable-workflow refs

cliffhall
and
claude
committed
2db4636
verify:action-pins: transitive artifact chains, aliases, default-only secret maps

cliffhall
and
claude
committed
f98e342
fix(storage): restore non-__proto__ Object.prototype names as valid store ids

BobDickinson
and
Copilot
committed
8d83c83
Merge pull request #2513 from modelcontextprotocol/v2/fix/2508-useservers-render-loop
cliffhall
authored
1527a46
test(web): configure React's act environment and wrap the updates it exposes

cliffhall
and
claude
committed
be98965
verify:action-pins: count secrets in the workflow-level env

cliffhall
and
claude
committed
cc80743
Merge pull request #2510 from modelcontextprotocol/v2/fix/2415-docker-healthcheck-launch-mode
cliffhall
authored
becc8c9
Merge pull request #2514 from modelcontextprotocol/v2/chore/2507-react-act-environment
cliffhall
authored
084b838
Merge pull request #2512 from modelcontextprotocol/v2/chore/2484-sha-pin-credential-actions
cliffhall
authored
64a50d6
fix(cli): rethrow permanent read failures at the --wait-for-auth deadline

BobDickinson
and
Copilot
committed
752eea6
fix(auth): compensate partial secret-store commits before degrading

BobDickinson
and
Copilot
committed
2d85cea
fix(auth): keep prior residue on memory-only degrade; sweep rename destination

BobDickinson
and
Copilot
committed
1205d7d
Merge remote-tracking branch 'origin/v2/main' into v2/feat/2481-oauth-tokens-secret-store
BobDickinson
committed
67ea28a
test: update degrade expectation for entry-level all-or-nothing revert

BobDickinson
and
Copilot
committed
d45cb27
test: fix semantic merge conflict in unredacted-classification test

BobDickinson
and
Copilot
committed
cabb007
fix(cli): bound --wait-for-auth reads by the wait deadline

BobDickinson
and
Copilot
committed
bcaf4a2
fix(auth): reject non-string secret values before they poison the store

BobDickinson
and
Copilot
committed
944dc32
fix(auth): share load/persist coordination per path; pin remote backend store id

BobDickinson
and
Copilot
committed
ba3c5b5
fix(auth): verify OAuth sectioned writes converge, re-applying over interleaved writers

BobDickinson
and
Copilot
committed
3abec6a
fix(auth): restore to a fold-rule baseline on failed sectioned writes

BobDickinson
and
Copilot
committed
311c615
docs(spec): double-failure store/file mismatch persists, not self-heals

BobDickinson
and
Copilot
committed
ca122e3
fix(auth): unify failure reconciliation and validate persisted token payloads

BobDickinson
and
Copilot
committed
d542c83
fix: keep unservable token payloads plaintext; serve them as no tokens

BobDickinson
and
Copilot
committed
b560321
docs: residue is not unconditionally secret-free

BobDickinson
and
Copilot
committed
f5b232a
fix: store partial token payloads instead of keeping them plaintext

BobDickinson
and
Copilot
committed
6b7c8ea
fix: persist only changed secret fields on section saves

BobDickinson
and
Copilot
committed
a1914bc
fix: serialize client.json combined writers and make bulk reads proto-safe

BobDickinson
and
Copilot
committed
fc55e11

Commits on Sep 27, 2026

Commits on Sep 28, 2026

Commits on Sep 30, 2026

chore(deps): upgrade the MCP TypeScript SDK to 2.2.0

cliffhall
and
claude
committed
d30a31c
chore(deps): upgrade the MCP Apps extension SDK to 2.0.3

cliffhall
and
claude
committed
4422f8d
Merge pull request #2526 from modelcontextprotocol/v2/chore/2521-sdk-2-2-0
cliffhall
authored
90704f3
Merge pull request #2527 from modelcontextprotocol/v2/chore/2522-ext-apps-2-0-3
cliffhall
authored
7ab8c5c
fix(deps): raise undici to ^8.11.2 for ten high-severity advisories

cliffhall
and
claude
committed
32c783f
fix(deps): refresh ip-address to 10.7.2 for three moderate advisories

cliffhall
and
claude
committed
921c8a4
fix(deps): refresh fast-uri to 3.1.8 for a moderate advisory

cliffhall
and
claude
committed
8d6f9f9
fix(deps): refresh brace-expansion to 5.0.12 in root, web and tui

cliffhall
and
claude
committed
b30ff27
chore(release): bump version to 2.9.0

cliffhall
and
claude
committed
754689d
Merge pull request #2529 from modelcontextprotocol/v2/chore/2528-bump-2-9-0
cliffhall
authored
c60fd53
chore: merge v2/main into main for the v2.9.0 release
cliffhall
committed
e78127a
fix(core): redact a form secret's raw-& tail in recorded bodies

cliffhall
and
claude
committed
7740bed
fix(cli): catch an opener that cannot be spawned instead of crashing

cliffhall
and
claude
committed
b50369d
fix(cli): call open from a queued microtask so the listener cannot lag

cliffhall
and
claude
committed
e5b0f7b
fix(core): fold a secret's tail across an empty segment

cliffhall
and
claude
committed
e4e1c77
Merge pull request #2534 from modelcontextprotocol/v2/fix/2531-cli-open-spawn-error
cliffhall
authored
6df9094
Merge pull request #2535 from modelcontextprotocol/v2/fix/2532-redactbody-raw-ampersand
cliffhall
authored
df9d348
chore: merge v2/main into main for the v2.9.0 release
cliffhall
committed
36f3d81
fix(cli): split trailing punctuation off redacted URLs in linear time

cliffhall
and
claude
committed
66dae5c
Merge pull request #2541 from modelcontextprotocol/v2/fix/2540-linear-trailing-punctuation
cliffhall
authored
7e606f5
chore: merge v2/main into main for the v2.9.0 release
cliffhall
committed
87bb185