Version Packages - #2555
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — standard auto-generated changesets release PR, no hand edits detected.
What was reviewed:
- Verified the newly consumed changeset (
streamable-http-sse-keepalive) matches merged PR #2541 (commit 470678d), and that in pre mode the .md file is correctly retained while being appended topre.json. - Checked version bumps for lockstep consistency: all public packages beta.5→beta.6; private
core-internalbeta.4→beta.5 in line with its own independent history. - Cross-checked CHANGELOG entries against the source changeset: the single minor change lands on
@modelcontextprotocol/server, with dependency-only patch bumps propagated to client, middleware adapters, and server-legacy as expected.
Extended reasoning...
Overview
PR #2555 is the auto-generated "Version Packages (beta)" PR from the changesets release action. It touches 21 files: 10 package.json version bumps, 10 CHANGELOG.md prepends, and one .changeset/pre.json update adding streamable-http-sse-keepalive to the consumed-changesets list. There is zero source code in the diff.
Security risks
None. The diff contains only version strings, changelog prose, and a pre-mode bookkeeping entry. No dependencies are added or changed (only workspace-internal version references), no workflow files are touched, and the changelog text is generated from an already-merged changeset.
Level of scrutiny
Low. This is the most mechanical PR class in the repository — the same shape as previously merged #2512 and its predecessors. The only meaningful checks are internal consistency (versions bump in lockstep, the consumed changeset corresponds to a merged commit, no manual edits snuck in), all of which pass: the new changeset maps to commit 470678d (PR #2541, already on main), all public packages move beta.5→beta.6, and the private core-internal moves beta.4→beta.5 consistent with its own changelog cadence. In pre mode changesets correctly retains the .md files and records consumption in pre.json, which is what the diff shows. The changelog entry for @modelcontextprotocol/server matches the source changeset text verbatim.
Other factors
The bug hunting system found no issues, and the PR timeline has no outstanding reviewer comments. Release timing remains a maintainer decision (merging publishes beta.6), but the content of the PR is deterministic bot output with nothing requiring human code review. Prior identical PRs in this repo were merged without substantive review feedback.
7c901eb to
e3b3b30
Compare
There was a problem hiding this comment.
LGTM — machine-generated changesets release PR (version bumps + changelog entries only), internally consistent.
What was reviewed: verified .changeset/pre.json consumes exactly the one new changeset (streamable-http-sse-keepalive from merged #2541); confirmed the fixed-group config explains all five core packages bumping to beta.6 together (including the empty core/codemod sections); checked core-internal's independent beta.4→beta.5 bump and the middleware packages' dependency-only bumps all match. No hand-edited content in the diff.
Note: approval covers the mechanical correctness of the version/changelog changes — release timing (when to merge and publish) remains the maintainers' call.
Extended reasoning...
Overview
This is the standard Version Packages (beta) PR opened by the changesets/action bot. It touches 21 files: .changeset/pre.json plus package.json version fields and CHANGELOG.md entries across the client, server, core, core-internal, codemod, server-legacy, and four middleware packages. No source code, build config, or CI changes are included.
Security risks
None. The diff contains only version strings and changelog prose generated from an already-merged changeset (#2541). No dependency ranges change (all internal deps use workspace: protocols), and no executable code is modified.
Level of scrutiny
Low. The content is deterministic output of changeset version in pre mode. I verified the internal consistency rather than trusting the bot blindly: the single new consumed changeset matches the merged commit 470678d in history; the fixed group in .changeset/config.json (core/client/server/server-legacy/codemod) accounts for the lockstep beta.6 bumps including the empty-section packages; core-internal (private, outside the fixed group) correctly bumps independently to beta.5; and the middleware packages carry only dependency-update patch entries. The server changelog's new minor entry accurately describes #2541 (SSE keep-alive frames), which shipped and was reviewed separately.
Other factors
The bug hunting system found no issues, and there are no prior reviews or unresolved comments on the timeline. The only judgment call a human retains here is release timing — merging publishes the beta prerelease — which is a process decision, not a code-review question, so shadow approval is appropriate.
e3b3b30 to
81b25a3
Compare
There was a problem hiding this comment.
LGTM — automated Changesets release PR; purely mechanical version bumps and generated changelogs.
What was reviewed:
- Verified the two consumed changesets (
streamable-http-sse-keepalive,validator-dialect-dispatch) exist on the branch and their frontmatter bump types (server minor; server+client patch) match the generated changelog sections verbatim. - Cross-checked commit refs in the dependency-cascade entries:
470678d(#2541) andf130e1a(#2534) are both on main. - Confirmed version bumps are consistent (public packages beta.5 → beta.6; private
core-internalbeta.4 → beta.5) and.changeset/pre.jsonadds both changeset names in the expected sorted position. No source files are touched.
Extended reasoning...
Overview
This is PR #2555, the automated "Version Packages (beta)" PR opened by the Changesets release GitHub Action. It touches 21 files, all of which are release bookkeeping: package.json version fields for 10 packages, their generated CHANGELOG.md entries, and .changeset/pre.json (recording the two newly consumed changesets). No runtime source code, build configuration, or CI workflow is modified.
Security risks
None. The diff contains only version strings and markdown changelog prose generated by the changesets tooling. Merging triggers a prerelease publish, but the published code is whatever is already on main (commits f130e1a and 470678d, each reviewed in its own PR); this PR adds no code of its own.
Level of scrutiny
Low — this is the canonical mechanical PR class. The correct check is internal consistency rather than logic review: I verified the changeset files on the branch match the generated changelog text and bump types exactly (server gets a minor for the SSE keep-alive feature, server+client get a patch for the validator dialect fix), that the dependency-cascade "Updated dependencies" entries in the middleware/express/fastify/hono/node/server-legacy changelogs reference the correct commits, and that all public packages move beta.5 → beta.6 while the private core-internal moves beta.4 → beta.5 (its own version line, expected since it lags one release). pre.json's changesets array gains the two names in sorted order, matching changesets pre-mode behavior.
Other factors
The bug hunting system found no issues, and the PR timeline has no reviewer comments to address. The repo is in changesets pre mode (beta tag), as the PR body notes, so the prerelease-only bump pattern is expected. Prior identical "Version Packages (beta)" PRs (e.g. the one merged as 81b25a3, #2512) followed the same shape. The only residual judgment — whether to actually cut this release now — belongs to the maintainers via the merge button, not to review of the diff's correctness.
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
81b25a3 to
656ce89
Compare
There was a problem hiding this comment.
Beyond the inline @beta dist-tag finding, I also verified the mechanical release content: all 20 workspace package.json bumps land consistently on 2.0.0, the deleted .changeset/pre.json was in mode: "exit" (standard prerelease-exit artifact), and the 28 deleted changeset files match the list pre.json recorded — the generated CHANGELOG entries correspond to those changesets. No issues found in the version/changelog mechanics themselves.
Extended reasoning...
This is a changesets-generated Version Packages PR that exits prerelease mode and bumps every package from 2.0.0-beta.x to stable 2.0.0. The single inline finding (docs/READMEs still instructing @beta installs, which the published tarballs would freeze) stands on its own. Separately, I checked the mechanical parts of the diff — version consistency across all 20 manifests, the pre.json exit-mode deletion, and that consumed changesets match pre.json's recorded list — and found them consistent, so a human reviewer can focus on the dist-tag/docs question and the publish decision itself. Not approving: this PR triggers an irreversible npm publish of 14 packages, which warrants human sign-off regardless of findings.
656ce89 to
ab6c325
Compare
There was a problem hiding this comment.
The @beta install-tag issue I flagged in my previous review is now resolved — #2566 landed on main and this regenerated release PR includes it (client/server READMEs drop the tag; codemod README and both migration guides now use @latest), so the 2.0.0 tarballs will ship correct install instructions. Leaving the merge decision to a human since this publishes the stable 2.0.0 GA to npm latest for the entire package family.
What was reviewed
- Re-checked all six previously flagged
@betalocations — none remain in the checkout at this PR's head. - Verified
.changeset/pre.jsondeletion (modeexit) and that every publishable package bumps consistently to 2.0.0 with changesets-generated changelogs matching the consumed changeset files. - Confirmed the codemod's version source (#2419, manifests-at-build-time) now emits
^2.0.0ranges once built from this tree.
Extended reasoning...
Overview
This is the changesets-generated "Version Packages" PR that exits prerelease mode (deletes .changeset/pre.json), consumes 28 changesets, and bumps all publishable packages (client, server, core, core-internal, server-legacy, codemod, four middleware adapters, and private test packages) from 2.0.0-beta.5 to stable 2.0.0. The diff is entirely machine-generated: version fields, CHANGELOG.md assembly, and changeset file deletions — no source code changes.
Security risks
None in the diff itself — no code changes. The operational risk is the publish side effect: merging triggers pnpm changeset publish to the npm latest dist-tag, which is immutable per-version. My prior run flagged that stale @beta install instructions would be baked into the 2.0.0 tarballs; that is now fixed by #2566, which this regenerated PR head includes.
Level of scrutiny
High for release mechanics, low for code correctness. I verified the mechanical consistency (versions, changelogs, pre.json removal) and re-verified the previously flagged documentation/tarball hazard is gone. What remains is a judgment call — whether the project is ready to ship 2.0.0 GA — which is inherently a maintainer decision, not something a bot should shadow-approve. A wrong publish here is effectively irreversible (npm versions cannot be republished).
Other factors
The prior review round's blocking finding was addressed on main rather than in this branch, and changesets regenerated the PR on top of it — so nothing in the earlier comment remains actionable. No outstanding human reviewer comments. CI/publish pipeline claims (changesets/action, pnpm changeset publish tagging behavior) were verified in the prior run and are unchanged.
ab6c325 to
0246fde
Compare
There was a problem hiding this comment.
My earlier dist-tag concern is resolved: #2566 (merged before this release commit) switched all six @beta install references — packages/client/README.md, packages/server/README.md, packages/codemod/README.md, and both migration guides — to @latest or untagged, so the 2.0.0 tarballs will ship correct install instructions. I found no issues in the regenerated diff, but merging publishes 2.0.0 to npm latest across all packages, so the GA ship decision itself belongs to a maintainer.
What was reviewed
.changeset/pre.jsondeletion (prerelease exit) against the release pipeline —pnpm changeset publishwith no--tagoverride lands 2.0.0 onlatest, as intended for GA- All package.json bumps to 2.0.0 and the aggregated CHANGELOGs — consistent with the consumed changesets, including the post-exit additions (#2534, #2564)
- Re-checked the six previously flagged
@betadoc locations in this checkout — all fixed
Extended reasoning...
Overview
This is the changesets-generated "Version Packages" PR for the SDK v2 GA release: it deletes .changeset/pre.json (exiting beta prerelease mode), deletes 32 consumed changeset files, bumps every workspace package from 2.0.0-beta.5 (or -beta.0/-beta.4) to 2.0.0, and prepends the aggregated 2.0.0 sections to each CHANGELOG. No source code changes — the diff is entirely manifest versions and generated changelog prose.
Security risks
None in the diff itself (version strings and markdown only). The release-pipeline consequence is the meaningful surface: merging triggers pnpm changeset publish, which publishes 2.0.0 to the npm latest dist-tag for ~10 public packages. That is an irreversible, outward-facing action, which is the reason I am not shadow-approving despite the mechanical diff.
Level of scrutiny
My previous run flagged a real release-hygiene bug: with prerelease mode exited, the beta dist-tag would freeze at 2.0.0-beta.5 while six documented install commands (baked into the immutable 2.0.0 tarballs) still said @beta, and the frozen beta.5 codemod would keep writing ^2.0.0-beta.5 ranges. That has been fixed by #2566 ("docs: comprehensive GA pass … install tags"), which precedes the release commit — I verified in this checkout that no @beta references remain in any markdown, and the six specific locations now read npm install @modelcontextprotocol/client / npx @modelcontextprotocol/codemod@latest …. The inline comment on the PR is marked resolved, consistent with this.
Other factors
I cross-checked the consumed changeset list against the generated changelogs: the 2.0.0 sections include the two changesets that landed after pre.json was last written (#2534 validator-dialect-dispatch, #2564 probe-auth-status), which is correct behavior when exiting pre mode — all pending changesets are consumed. Internal test packages (test/*) also bump to 2.0.0 but are private: true. Nothing in the diff contradicts the release workflow; the only open question is the human one of whether the project is ready to ship GA, which a bot should not answer.
1 participant
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@modelcontextprotocol/client@2.0.0
@modelcontextprotocol/core@2.0.0
@modelcontextprotocol/server@2.0.0
@modelcontextprotocol/server-legacy@2.0.0
@modelcontextprotocol/codemod@2.0.0
@modelcontextprotocol/express@2.0.0
@modelcontextprotocol/fastify@2.0.0
@modelcontextprotocol/hono@2.0.0
@modelcontextprotocol/node@2.0.0
@modelcontextprotocol/core-internal@2.0.0
@modelcontextprotocol/test-conformance@2.0.0
@modelcontextprotocol/test-e2e@2.0.0
@modelcontextprotocol/test-helpers@2.0.0
@modelcontextprotocol/test-integration@2.0.0