Release v2.3.0 #5425

Activity

1. cliffhall

   added this to the v2.3.0 milestone on Nov 4, 2026
2. cliffhall

   added

   v2

   choreMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior changeMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior change

   on Nov 4, 2026
3. cliffhall

   self-assigned this

   on Nov 4, 2026
4. cliffhall commented on Nov 4, 2026

   

   cliffhall

   on Nov 4, 2026

   MemberAuthor

   More actions

   v2.3.0 release audit

   Tree: origin/v2/main at 72ad22c6. Commands: the release skill, step 2a.

   Lockfile	Tool	Result
   package-lock.json (root + 4 TypeScript workspaces)	npm audit --audit-level=high	Nothing high or critical (exit 0). 2 moderate advisories, 12 affected paths
   src/fetch/uv.lock	pip-audit --require-hashes	No known vulnerabilities found
   src/git/uv.lock	pip-audit --require-hashes	No known vulnerabilities found
   src/time/uv.lock	pip-audit --require-hashes	No known vulnerabilities found

   All three Python servers were audited (the skill's EXIT=0).

   Findings and outcomes

   Advisory	Package, path	Reaches	Outcome
   GHSA-6pq8-jhm2-2vcw (moderate, DoS)	qs <=6.16.0, lock held 6.16.0, via express	everything (transitively). Downstream installs already resolve a fixed qs through express's own range	Fix inside the range: the root override qs >=6.16.0 → >=6.16.1, relocked to 6.17.1. Audit PR, no changeset (no published manifest changes)
   GHSA-g3hv-75wg-m249 (moderate, DoS)	minimatch <11.0.1; filesystem declares ^10.0.1 (10.2.5)	filesystem, from the client: search_files patterns and excludePatterns	Fix needs a major: its own issue and PR, #5420 (outside report), triaged into v2.3.0. The release is held for it
   same	minimatch 10.2.5 under eslint / typescript-eslint	Nothing published: root devDependencies (lint tooling)	Not reachable from any server. Stays until eslint moves to minimatch 11

   npm audit fix was not run.
5. cliffhall

   linked a pull request that will close this issuefix(deps): v2.3.0 release audit, raise the qs override to >=6.16.1 #5427on Nov 4, 2026
6. cliffhall

   linked a pull request that will close this issuechore: version packages #5401on Nov 4, 2026
7. cliffhall

   linked a pull request that will close this issuechore: stamp Python CalVer versions for 2026.11.4 #5429on Nov 4, 2026
8. cliffhall

   linked a pull request that will close this issuechore: version packages #5437on Nov 4, 2026
9. cliffhall commented on Nov 4, 2026

   

   cliffhall

   on Nov 4, 2026

   MemberAuthor

   More actions

   v2.3.0 is published: https://github.com/modelcontextprotocol/servers/releases/tag/v2.3.0. All seven packages are live on npm and PyPI.
10. cliffhall

    closed this as completedon Nov 4, 2026