Version Packages (beta)#2512
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — mechanical changesets release PR (beta.5), generated by the release action with no hand edits.
What was reviewed:
- Version bumps match the sole new changeset (
export-protocol-class, from merged #2501): minor for client/server/core-internal, patch for codemod, exactly as its frontmatter declares. - Fixed-group behavior checked: core/client/server/server-legacy/codemod move to 2.0.0-beta.5 together; core's empty changelog entry and server-legacy's deps-only entry are standard for group members with no direct change.
.changeset/pre.jsonadds onlyexport-protocol-classto the consumed list; the changeset file remains on disk, which is correct in pre mode.- Middleware packages (express/fastify/hono/node) bump as patch dependents of server, as expected.
Extended reasoning...
Overview
PR #2512 is the auto-generated "Version Packages (beta)" PR from the changesets release GitHub action. It touches 21 files: .changeset/pre.json plus package.json version fields and CHANGELOG.md entries for 10 packages. There are zero source-code changes — every hunk is mechanical changesets output.
Verification performed
The only new changeset consumed since beta.4 is export-protocol-class (PR #2501, merged as commit 1480241, the direct parent of this PR's commit). I read the changeset's frontmatter and confirmed the released bump levels match exactly: minor for @modelcontextprotocol/client, @modelcontextprotocol/server, and @modelcontextprotocol/core-internal; patch for @modelcontextprotocol/codemod. The .changeset/config.json fixed group (core, client, server, server-legacy, codemod) explains why all five move to 2.0.0-beta.5 together — including core's empty changelog section and server-legacy's deps-only entry, which are normal for fixed-group members with no direct change. core-internal (private, outside the fixed group) independently bumps beta.3 → beta.4. The four middleware packages bump as patch dependents of server. Per the repo's review conventions I also read the changelog prose against the implementation it describes — it is a verbatim copy of the #2501 changeset text, and that PR's export/codemod changes are already merged, so the prose promises nothing the code doesn't ship. In pre mode the changeset files correctly remain on disk while pre.json records consumption; the diff adds exactly one entry there.
Security risks
None. No executable code, dependencies, or CI configuration change — only version strings and changelog markdown. Publishing is a separate step taken by a maintainer merging this PR.
Level of scrutiny
Low. This is the canonical example of a machine-generated, mechanical PR: the changesets action produced it deterministically from already-reviewed, already-merged changesets. The human review effort belongs on the underlying PRs (here, #2501, which went through its own review), not on the version-bump artifact. The main judgment call — whether now is the right time to cut beta.5 — rests with whoever merges, and approval does not force that timing.
Other factors
The bug hunting system found no issues. The PR timeline has no reviewer comments or unresolved threads, and I have no prior reviews on this PR. Sibling "Version Packages (beta)" PRs (#2484 and earlier) follow the identical pattern and merged cleanly.
f2cca18 to
3547bb2
Compare
There was a problem hiding this comment.
LGTM — mechanical changesets "Version Packages (beta)" release PR generated by the changesets action.
What was reviewed
- Version bumps match the fixed group (
core/client/server/server-legacy/codemodall → 2.0.0-beta.5) andcore-internal(private, → 2.0.0-beta.4); middleware packages bump as dependents ofserver. .changeset/pre.jsongains exactly the two new changeset entries (export-protocol-classfrom #2501,prior-legacy-verdictfrom #2511), both files present and their frontmatter matches the generated changelog placement.- Changelog text is a verbatim copy of the changeset files; the empty
core@2.0.0-beta.5section is the expected fixed-group ride-along.
Extended reasoning...
Overview
PR #2512 is the automated "Version Packages (beta)" PR opened by the changesets/action bot. It touches 21 files: .changeset/pre.json plus package.json version fields and CHANGELOG.md prepends across the client, server, core, core-internal, codemod, server-legacy, and four middleware packages. No source code, build config, or CI changes are included.
Security risks
None. The diff contains only version-string bumps, changelog prose, and pre-mode bookkeeping in pre.json. No dependencies are added or changed (only workspace:-resolved internal versions move), and no executable code is modified.
Level of scrutiny
Low — this is the canonical mechanical release PR shape this repo merges on every release cycle (e.g. #2484 in recent history). The correct check is internal consistency of the generated output, which I verified: the .changeset/config.json fixed group ([core, client, server, server-legacy, codemod]) moves together to 2.0.0-beta.5; the private core-internal bumps independently beta.3 → beta.4; the four middleware packages bump as dependents of server; pre.json adds exactly the two changesets landed since the last release (export-protocol-class / #2501 and prior-legacy-verdict / #2511), both of which correspond to commits in main's history (1480241, f60dff0). Changelog entries are verbatim copies of the changeset files, with #2511 correctly appearing only in the client package.
Other factors
The bug hunting system found no bugs. The PR timeline has no human review comments or unresolved discussion. The substantive changes being released (#2501, #2511) were reviewed in their own PRs — this PR only records them. Per the repo's review conventions, changeset prose was checked against what the referenced commits claim to ship, and nothing in this diff contradicts them.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
mainis currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, runchangeset pre exitonmain.Releases
@modelcontextprotocol/client@2.0.0-beta.5
Minor Changes
#2501
1480241Thanks @felixweinberger! - Export theProtocolbase class andmergeCapabilitiesfrom the@modelcontextprotocol/clientand@modelcontextprotocol/serverpackage roots, restoring the v1 import for consumers that subclassProtocol(e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.The codemod now rewrites
ProtocolandmergeCapabilitiesimports fromshared/protocol.jsto the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.#2511
f60dff0Thanks @felixweinberger! -ConnectOptions.prioraccepts a cached era verdict — the new exported typePriorDiscovery.{ kind: 'modern', discover }adopts a previously obtainedDiscoverResultwith zero round trips;{ kind: 'legacy' }skips theserver/discoverprobe and runs the plaininitializehandshake directly, for servers known out-of-band to be legacy — without pinning the client tomode: 'legacy': stop supplying the verdict andconnect()falls back to the configuredversionNegotiationmode (under'auto', it re-probes and rediscovers an upgraded server). Freshness is the supplying host's responsibility — a stale legacy verdict succeeds silently against an upgraded server, so hosts must date cached legacy verdicts in their own storage and stop supplying them past their policy horizon. Persisted-blob plumbing is hardened:prior: nullis treated as absent, the modern arm'sdiscoverpayload is schema-validated before any connection state changes, and an unrecognized shape rejects with a typedSdkError(EraNegotiationFailed)instead of aTypeError.Patch Changes
@modelcontextprotocol/server@2.0.0-beta.5
Minor Changes
#2501
1480241Thanks @felixweinberger! - Export theProtocolbase class andmergeCapabilitiesfrom the@modelcontextprotocol/clientand@modelcontextprotocol/serverpackage roots, restoring the v1 import for consumers that subclassProtocol(e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.The codemod now rewrites
ProtocolandmergeCapabilitiesimports fromshared/protocol.jsto the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.Patch Changes
@modelcontextprotocol/codemod@2.0.0-beta.5
Patch Changes
#2501
1480241Thanks @felixweinberger! - Export theProtocolbase class andmergeCapabilitiesfrom the@modelcontextprotocol/clientand@modelcontextprotocol/serverpackage roots, restoring the v1 import for consumers that subclassProtocol(e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.The codemod now rewrites
ProtocolandmergeCapabilitiesimports fromshared/protocol.jsto the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.@modelcontextprotocol/express@2.0.0-beta.5
Patch Changes
1480241]:@modelcontextprotocol/fastify@2.0.0-beta.5
Patch Changes
1480241]:@modelcontextprotocol/hono@2.0.0-beta.5
Patch Changes
1480241]:@modelcontextprotocol/node@2.0.0-beta.5
Patch Changes
1480241]:@modelcontextprotocol/server-legacy@2.0.0-beta.5
Patch Changes
@modelcontextprotocol/core@2.0.0-beta.5
@modelcontextprotocol/core-internal@2.0.0-beta.4
Minor Changes
#2501
1480241Thanks @felixweinberger! - Export theProtocolbase class andmergeCapabilitiesfrom the@modelcontextprotocol/clientand@modelcontextprotocol/serverpackage roots, restoring the v1 import for consumers that subclassProtocol(e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.The codemod now rewrites
ProtocolandmergeCapabilitiesimports fromshared/protocol.jsto the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.Patch Changes