Repository navigation

chore(release): merge v2/main into main for v2.12.0 - #2769

Merged

cliffhall merged 74 commits into

mainfrom

v2/chore/milestone-merge-v2.12.0

Oct 21, 2026

Merged

chore(release): merge v2/main into main for v2.12.0#2769
cliffhall merged 74 commits into
mainfrom
v2/chore/milestone-merge-v2.12.0

Commits on Oct 7, 2026
- docs: retroactive DCO signoff for cliffhall's unsigned commits (#2617)
  cliffhall
  committed
  c9dd35d
- Merge branch 'v2/main' into v2/docs/2617-dco-retroactive-signoffs
  cliffhall
  authored
  8cbb07a
Commits on Oct 19, 2026
- fix: bump open to v11 and restrict openUrl to http(s)
  
  cliffhall
  and
  claude
  committed
  094847a
Commits on Oct 20, 2026
- test(cli): isolate the suite's OAuth state from ~/.mcp-inspector (#2719)
  
  cliffhall
  and
  claude
  committed
  8bee8cd
- fix: resolve a request's Protocol entry when its send fails
  
  cliffhall
  and
  claude
  committed
  756318c
- ci: install pinned npm 11 before every dependency install
  
  cliffhall
  and
  claude
  committed
  6fcbefe
- feat(web): optional TLS for the web UI listener
  
  cliffhall
  and
  claude
  committed
  b54eb82
- fix(subscriptions): stop retrying a subscriptions/listen refused over HTTP
  
  cliffhall
  and
  claude
  committed
  9365059
- fix(auth): carry a superseded namespace's client secret across a backend switch
  
  cliffhall
  and
  claude
  committed
  26a1b67
- fix(web): reject empty TLS PEM files; isolate the env-reading TLS test
  
  cliffhall
  and
  claude
  committed
  43afcdb
- fix: let a folded JSON-RPC error body replace a failed send's clientError
  
  cliffhall
  and
  claude
  committed
  619b620
- fix(auth): record a credential's owner when written, and harden the carry-over
  
  cliffhall
  and
  claude
  committed
  b4c352f
- fix(auth): trust the keychain's owner, stop at a failed carry, record only written owners
  
  cliffhall
  and
  claude
  committed
  b37c6f6
- fix(auth): record owners only for held values, and skip ambiguous hand-off owners
  
  cliffhall
  and
  claude
  committed
  cde08e2
- Merge pull request #2728 from modelcontextprotocol/v2/fix/2719-cli-test-oauth-isolation
  cliffhall
  authored
  f9ae106
- Merge pull request #2733 from modelcontextprotocol/v2/fix/2721-protocol-tab-403-pending
  cliffhall
  authored
  455a1c1
- docs: retroactive DCO signoff for olaservo's unsigned commits (#2617)
  olaservo
  committed
  57ee659
- fix(auth): carry once per namespace before purging any location it covers
  
  cliffhall
  and
  claude
  committed
  17993dd
- Merge pull request #2730 from modelcontextprotocol/v2/fix/2722-listen-http-refusal
  cliffhall
  authored
  8c5ef64
- Merge pull request #2732 from modelcontextprotocol/v2/feat/2446-web-tls
  cliffhall
  authored
  e5479fe
- Merge pull request #2729 from modelcontextprotocol/v2/chore/2715-ci-npm-11
  cliffhall
  authored
  44a41d2
- Merge pull request #2731 from modelcontextprotocol/v2/fix/2672-carry-secrets-across-backend-switch
  cliffhall
  authored
  d0714d5
- fix(auth): carry a client credential only for the client its store stamp names
  
  cliffhall
  and
  claude
  committed
  24952c5
- test(tui): pin MCP_INSPECTOR_LOG_DIR to a per-file temp dir
  
  cliffhall
  and
  claude
  committed
  d43559b
- ci: scan v2/main with a committed CodeQL advanced-setup workflow
  
  cliffhall
  and
  claude
  committed
  a781eb3
- fix(ema): allow a public resource-AS client in leg 3
  
  cliffhall
  and
  claude
  committed
  b089515
- Merge pull request #2735 from modelcontextprotocol/v2/fix/2723-tui-test-log-dir
  cliffhall
  authored
  b24f44c
- feat(core): recognize HTTP 429 and surface the server's Retry-After
  
  cliffhall
  and
  claude
  committed
  c640056
- Merge pull request #2736 from modelcontextprotocol/v2/fix/2725-ema-public-resource-client
  cliffhall
  authored
  5642739
- fix(oauth): refresh an expired token behind an insufficient_scope challenge
  
  cliffhall
  and
  claude
  committed
  1a536d0
- fix(core): correlate each 429's Retry-After by JSON-RPC id, not by time
  
  cliffhall
  and
  claude
  committed
  ea35ae3
- fix(auth): write a carried credential's stamp before its value
  
  cliffhall
  and
  claude
  committed
  9285a96
- fix: open the URL that was checked, not the raw input
  
  cliffhall
  and
  claude
  committed
  f7e0377
- Merge pull request #2741 from modelcontextprotocol/v2/chore/2545-codeql-advanced-setup
  cliffhall
  authored
  fa11e43
- fix(oauth): judge step-up refresh coverage against persisted scope
  
  cliffhall
  and
  claude
  committed
  0934e38
- fix(auth): key in-flight PKCE verifiers by flow, not server URL
  
  cliffhall
  and
  claude
  committed
  3fbf2a9
- Merge pull request #2618 from modelcontextprotocol/v2/docs/2617-dco-retroactive-signoffs
  cliffhall
  authored
  36e251c
- fix(core): annotate 429s on the raw-wire path; reject impossible dates
  
  cliffhall
  and
  claude
  committed
  4c02f4b
- test(auth): keep one storage area in the cross-server flow-store test
  
  cliffhall
  and
  claude
  committed
  3fd5b5b
- Merge pull request #2738 from modelcontextprotocol/v2/fix/2724-insufficient-scope-expired-token
  cliffhall
  authored
  fd82b10
- Merge pull request #2737 from modelcontextprotocol/v2/feat/2442-rate-limit-detection
  cliffhall
  authored
  95ea670
- Merge branch 'v2/main' into v2/fix/2726-per-flow-pkce-verifier
  
  cliffhall
  and
  claude
  committed
  844a14d
- fix(auth): bind an owner stamp with an HMAC keyed by the credential
  
  cliffhall
  and
  claude
  committed
  15de439
- feat(cli): add --load mode for load-testing a tool
  
  cliffhall
  and
  claude
  committed
  25e5a26
- Merge pull request #2742 from modelcontextprotocol/v2/fix/2726-per-flow-pkce-verifier
  cliffhall
  authored
  c136514
- fix(cli): drop missed --load-rate slots and recheck the deadline after a wait
  
  cliffhall
  and
  claude
  committed
  9649799
- Merge pull request #2739 from modelcontextprotocol/v2/fix/2734-handoff-owner-provenance
  cliffhall
  authored
  1b4d4ec
- fix(cli): claim a --load-rate slot only after waking
  
  cliffhall
  and
  claude
  committed
  bc6db3e
- fix(cli): one timer per --load-rate slot, and hold the average rate
  
  cliffhall
  and
  claude
  committed
  4e13034
- fix(skills): require ttlMs and cacheScope on modern resources/directory/read results (#2740)
  
  olaservo
  and
  claude
  committed
  721d314
- Merge pull request #2743 from modelcontextprotocol/v2/feat/2439-cli-load-test
  cliffhall
  authored
  3e06c0c
- Merge pull request #2747 from modelcontextprotocol/v2/fix/2740-directory-read-cacheable
  olaservo
  authored
  fefe074
Commits on Oct 21, 2026
- fix(web): validate the Host header on the production web server
  
  cliffhall
  and
  claude
  committed
  1239983
- fix(web): restrict Host names to hostname characters, punycode allowed-host entries
  
  cliffhall
  and
  claude
  committed
  4c31c6b
- fix(web): cap the /api/fetch response body
  
  cliffhall
  and
  claude
  committed
  3d701a0
- fix(web): relay an error status whose /api/fetch body is over the cap
  
  cliffhall
  and
  claude
  committed
  53d1c62
- docs(web): state the IP forms the Host allow-list accepts
  
  cliffhall
  and
  claude
  committed
  28eda4c
- Merge commit from fork
  cliffhall
  authored
  73f3cf8
- Merge commit from fork
  cliffhall
  authored
  8d74f7a
- Merge commit from fork
  cliffhall
  authored
  4862b74
- chore: bump version to 2.12.0
  
  cliffhall
  and
  claude
  committed
  51c7ffe
- Merge pull request #2763 from modelcontextprotocol/v2/chore/2762-bump-2-12-0
  cliffhall
  authored
  7e20e38
- chore: merge v2/main into main for the v2.12.0 release
  cliffhall
  committed
  b861af2
- fix(cli): link https in --print-handoff when the web UI is served over TLS
  
  cliffhall
  and
  claude
  committed
  9edc173
- fix(web): drop the dropped body's framing headers from an oversize error relay
  
  cliffhall
  and
  claude
  committed
  cbb3c65
- Merge pull request #2773 from modelcontextprotocol/v2/fix/2770-handoff-tls-scheme
  cliffhall
  authored
  20287a6
- Merge pull request #2774 from modelcontextprotocol/v2/fix/2771-oversize-error-framing-headers
  cliffhall
  authored
  360f3c6
- chore: merge v2/main into the v2.12.0 milestone merge (#2770, #2771)
  cliffhall
  committed
  bd7e9c7
- fix(mcpdo): give resources/directory/read a URI and a cursor
  
  cliffhall
  and
  claude
  committed
  3a174cb
- Merge pull request #2775 from modelcontextprotocol/v2/fix/2767-mcpdo-directory-read-uri
  cliffhall
  authored
  63c5a06
- chore: merge v2/main into the v2.12.0 milestone merge (#2767)
  cliffhall
  committed
  c2834cb
- fix(core): keep the connection up when a request POST is HTTP-refused
  
  cliffhall
  and
  claude
  committed
  6b108c3
- Merge pull request #2777 from modelcontextprotocol/v2/fix/2776-listen-refusal-node-onerror
  cliffhall
  authored
  3cdde6c
- chore: merge v2/main into the v2.12.0 milestone merge (#2776)
  cliffhall
  committed
  50c0b25

Commits

Commits on Oct 7, 2026

Commits on Oct 19, 2026

Commits on Oct 20, 2026

Commits on Oct 21, 2026