[ViperJuice]

Cuts 2.2.0 from the three merged fixes: #155, #157, #159.

Why minor, not patch

#159 removes four fields from public tool output — update_warning from describe/invoke/provision, and stale_updates from catalog_search. Those were emitted on the wire as explicit nulls (model_dump() runs without exclude_none), so a client doing a key-presence check sees a real change. That is a breaking change to the tool surface, so patch would be wrong.

What's in it

All three commits are one coherent theme — version handling that told the truth or said nothing:

• fix: version comparison fails closed instead of fabricating update notices #155 — version comparison fails closed. A server reporting nightly, build-1 or an empty string previously compared as older than any real release and produced an update notice that was never true. An empty version is the current MCP SDK default, so this was reachable in ordinary use. Now uses packaging.version.
• fix: update probe no longer orphans its process tree on timeout #157 — the update probe no longer orphans its process tree on timeout. It spawns as a process-group leader and reaps the group, so a package that ignores the probe flag no longer leaves a browser holding the Playwright profile lock.
• fix: remove the automatic update notices (#150) #159 — the automatic update notices are removed outright, after eight attempts to make them correct. The gateway cannot observe which artifact a running server executes, so the notice could be wrong in both directions.

I verified #155 and #157 are not made dead by #159: is_version_newer/is_version_orderable still back refresher.py (the pmcp refresh --check-versions path), and the probe fix still backs update_server. Nothing shipped here is unreachable.

What users get

gateway.update_server and pmcp refresh --check-versions still report versions on request. What's gone is the gateway volunteering a claim it could not substantiate.

Housekeeping folded in

• Merged the two duplicate ### Fixed headings that accumulated under [Unreleased] from three separate PRs.
• Synced src/pmcp/__init__.py:__version__, which was still 2.1.1 — bumping pyproject.toml alone would have shipped a runtime version that disagreed with the package metadata.

Verification

• pytest -q → 2548 passed, 3 skipped, 0 failed
• ruff check ., mypy src — clean
• Version agreement asserted at runtime: pmcp.__version__ == pyproject version == 2.2.0

Known, deliberately not blocking

#156 (semver follow-ups) and #151 (update_server TOCTOU) are pre-existing and present in 2.1.1 — not regressions from these commits — so holding the release would delay the fabricated-notice fix without protecting anyone.

Worth flagging: #151 is more severe as of #159. With the notices gone, update_server is the sole update path, so a config-resolution race there no longer has a second mechanism around it. Recommend it as the next piece of work.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}