From 8d74c40d56769d73cf1f0062d2c0bd1685b96a54 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 10 Oct 2026 09:23:48 +0000 Subject: [PATCH 1/2] chore(release): 0.7.0 Bump the version to 0.7.0 and add CHANGELOG.md with the 0.7.0 entry (#25, #26, #27). Ship the changelog in the npm package, and make the release workflow fail when CHANGELOG.md has no entry for the tagged version and use that entry as the GitHub Release body. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01AK8gZCAMiLzJt6vCjwERPJ --- .github/workflows/release.yml | 10 ++++++++++ CHANGELOG.md | 28 ++++++++++++++++++++++++++++ package-lock.json | 4 ++-- package.json | 3 ++- 4 files changed, 42 insertions(+), 3 deletions(-) create mode 100644 CHANGELOG.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c6b043e..7ca520a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,6 +57,15 @@ jobs: fi echo "version=$PKG_VERSION" >> $GITHUB_OUTPUT + - name: Extract changelog entry + run: | + VERSION="${{ steps.verify.outputs.version }}" + awk -v v="## [$VERSION]" '$0==v{f=1;next} /^## \[/{f=0} f' CHANGELOG.md > RELEASE_NOTES.md + if ! grep -q '[^[:space:]]' RELEASE_NOTES.md; then + echo "CHANGELOG.md has no entry for ## [$VERSION]" >&2 + exit 1 + fi + - name: Typecheck run: npm run typecheck @@ -77,6 +86,7 @@ jobs: with: tag_name: v${{ steps.verify.outputs.version }} name: v${{ steps.verify.outputs.version }} + body_path: RELEASE_NOTES.md generate_release_notes: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..2f57eac --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,28 @@ +# Changelog + +All notable changes to `toolception` are listed here. Versions follow [semver](https://semver.org/); while the major version is 0, a minor bump can contain breaking changes. + +Releases before 0.7.0 are described in [GitHub Releases](https://github.com/code-rabi/toolception/releases). + +## [0.7.0] + +### Breaking + +- In STATIC mode every client now gets its own `McpServer` and orchestrator, like DYNAMIC mode. Module loaders run once per client instead of once per process, with each client's merged session context. ([#27](https://github.com/code-rabi/toolception/pull/27)) + +### Fixed + +- STATIC mode supports concurrent clients. Before, a second client's `initialize` closed the first client's connection, and its next request failed with `Session not found or expired`. ([#27](https://github.com/code-rabi/toolception/pull/27)) +- Per-session context (`?config=`) now reaches module loaders in STATIC mode. ([#27](https://github.com/code-rabi/toolception/pull/27)) +- Tools defined with a JSON Schema `inputSchema` load and receive their arguments on MCP SDK 1.28+, which rejects plain JSON Schema objects. ([#25](https://github.com/code-rabi/toolception/pull/25)) + +### Changed + +- Now depends on `@modelcontextprotocol/sdk` `^1.32.1` and `fastify` `^5.12.5`. ([#25](https://github.com/code-rabi/toolception/pull/25)) +- The `zod` dependency floor is now `^3.25`, matching the MCP SDK's peer range. ([#26](https://github.com/code-rabi/toolception/pull/26)) +- Every tool, meta-tools included, registers through `McpServer.registerTool` instead of the deprecated `server.tool()` overloads. `annotations.title` is also sent as the tool's top-level `title`. ([#26](https://github.com/code-rabi/toolception/pull/26)) +- JSON Schema inputs are accepted but not advertised to clients; use Zod shapes to advertise a tool's parameters. ([#25](https://github.com/code-rabi/toolception/pull/25), [#26](https://github.com/code-rabi/toolception/pull/26)) + +### Security + +- Patched vulnerable dependencies: MCP SDK (GHSA-6qxp-vccf-f47h), fastify, and transitive packages (proxy-addr, hono, path-to-regexp, qs, fast-uri, ip-address). Dev tooling moved to vitest 5. ([#25](https://github.com/code-rabi/toolception/pull/25)) diff --git a/package-lock.json b/package-lock.json index 7c905c5..0a6a533 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "toolception", - "version": "0.6.3", + "version": "0.7.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "toolception", - "version": "0.6.3", + "version": "0.7.0", "license": "Apache-2.0", "dependencies": { "@fastify/cors": "^10.0.1", diff --git a/package.json b/package.json index a20cbd4..b629d4c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "toolception", - "version": "0.6.3", + "version": "0.7.0", "private": false, "type": "module", "main": "dist/index.js", @@ -9,6 +9,7 @@ "files": [ "dist", "README.md", + "CHANGELOG.md", "LICENSE" ], "scripts": { From 84c45c52c484d74b25439652707293e95d8034e5 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 10 Oct 2026 09:37:48 +0000 Subject: [PATCH 2/2] docs(changelog): add STATIC-mode migration note for createServer registration Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01AK8gZCAMiLzJt6vCjwERPJ --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f57eac..7a4042d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ Releases before 0.7.0 are described in [GitHub Releases](https://github.com/code ### Breaking - In STATIC mode every client now gets its own `McpServer` and orchestrator, like DYNAMIC mode. Module loaders run once per client instead of once per process, with each client's merged session context. ([#27](https://github.com/code-rabi/toolception/pull/27)) + - **Migration:** anything you register on the server returned by `createMcpServer` after it is created (prompts, resources, extra tools) no longer reaches STATIC clients. Register it inside your `createServer` factory instead, so every per-client server gets it. ### Fixed