Repository navigation
Release v1.0.0 #5080
Description
The release issue for milestone v1.0.0, cut through the release skill. Every preparation PR and the merge PR reference it; it stays open until the GitHub Release is published.
Part of #4968, which carries the scope and the post-release steps (the npm deprecate of the date-stamped versions).
Steps
- 2a. Audit (
npm audit,pip-auditper Python server); report posted here - 2b. TypeScript at
1.0.0: fold the pending changesets into a1.0.0CHANGELOG entry per server and delete them (per First semver release: TypeScript servers at 1.0.0 and Python servers at the next CalVer, the frozen legacy-era servers #4968, instead of merging Version Packages chore: version packages #4941, which would bump to2.0.0) - 2c. Prepare Python Release (CalVer stamp)
- 3. Merge PR
v2/main→main(Part of #N);git merge-treemust yieldorigin/v2/main's tree - 4. Release ledger:
local:gate,pack:verify, every closed milestone issue exercised - 5. Draft release notes; a maintainer publishes the Release and approves the
releaseenvironment - 6. Verify on npm and PyPI; close this issue
Known blocker for step 3
git merge-tree --write-tree origin/main origin/v2/main conflicts in CONTRIBUTING.md: the contribution-policy sync commits on main (#4939 and follow-ups) hold an older copy than v2/main's (which added the coverage-gate wording in 1cdd4a70). It is the only main-side change that differs from v2/main.
Activity
cliffhall commentedon Oct 10, 2026
Audit report (step 2a)
Run on
origin/v2/mainat1a9554d1:npm audit(root lockfile, all four workspaces) andpip-audit --require-hashesoveruv export --frozenfor each Python server. Every Python server returned a verdict (EXIT=0).Found: npm 15 (1 critical, 9 high, 5 moderate); Python fetch 22 in 5 packages, git 40 in 3, time 16 in 2.
Outcomes (decided by @cliffhall): every finding with a fix inside its declared range is fixed in #5082, one commit per package.
overrides)braces(GHSA-vfj7-8cjw-p6xm, high): no patched release. Dev only, throughshx; not reachable from a published serverNone needed a major.
After #5082:
npm auditreports onlybraces, andpip-auditreports "No known vulnerabilities found" for fetch, git and time (pyjwt PYSEC-2026-4146, which had no listed fix version, also clears at 2.15.1).cliffhall commentedon Oct 10, 2026
Change of plan: v1.0.0 is cut from before the SDK v2 migration
Maintainer decision (@cliffhall): v1.0.0 releases the legacy-era servers on SDK 1.x, from
d8120439(the lastv2/maincommit before #5063), plus cherry-picks of #5077 (#5060) and #5078 (#5076). The SDK v2 migration (#4856, #4851) moves to 2.0.0, where its breaking changes (Node 20 floor,-32602for unknown tools, 2020-12 schemas) belong.Because
v2/mainis already past that commit, this release uses a one-time release branch,v2/release/1.0.0(cut atd8120439), as an exception to the flow in thereleaseskill:v2/release/1.0.0: the cherry-picks, a fresh audit (its lockfile is SDK 1.x), the changeset fold into a1.0.0CHANGELOG (no SDK v2 entries), the Python CalVer stamp.v2/release/1.0.0→main. Release v1.0.0: merge v2/main into main #5085 (v2/main→main) is closed unmerged.v2/mainis reconciled once: the four*-sdk-v2.mdmajor changesets restored, the CHANGELOGs aligned with what shipped, andv2/release/1.0.0merged intov2/main, so the next milestone merge is clean.#5082/#5083/#5084 stay on
v2/main(they apply to the SDK v2 tree) and are reconciled in step 4. The first audit report above was run on the post-migration tree; a new one follows for this tree.cliffhall commentedon Oct 10, 2026
Audit report for the release branch (step 2a, SDK 1.x tree)
Run on
v2/release/1.0.0atd8120439, same method as the report above. Every Python server returned a verdict.Found: npm 17 (1 critical, 11 high, 5 moderate); Python fetch 24, git 42, time 18.
Outcomes (maintainer: fix everything in range), in the release-branch audit PR:
@modelcontextprotocol/sdkGHSA-6qxp-vccf-f47h (OAuth client, not used by these servers): floor^1.30.0→^1.31.0, patch changeset per server;fast-uri3.1.8 (override);anyio4.15.1 (lock)braces(dev only, viashx)After:
npm auditreports onlybraces;pip-auditclean for fetch, git and time.docs(contributing): sync with v2/main after 1cdd4a7
cliffhall commentedon Oct 11, 2026
Published
Release v1.0.0, tag
v1.0.0at the merge commitc003d0d8(tree7b843d76, the tree the release ledger verified).release.ymlrun 38105912909: 15/15 jobs succeeded.@modelcontextprotocol/server-everythinglatest, SLSA provenance@modelcontextprotocol/server-filesystemlatest, SLSA provenance@modelcontextprotocol/server-memorylatest, SLSA provenance@modelcontextprotocol/server-sequential-thinkinglatest, SLSA provenancemcp-server-fetchmcp-server-gitmcp-server-timeRemaining, tracked on #4968: the one-time
npm deprecateof the date-stamped versions (pre-check passes:latestis 1.0.0 on all four,2026.8.31not yet deprecated), and reconcilingv2/mainwithv2/release/1.0.0.Sync upstream main and refresh Garnet recorder pins (#20)