chore(release): 0.7.0

.github/workflows/release.yml

@@ -57,6 +57,15 @@ jobs:
           fi
           echo "version=$PKG_VERSION" >> $GITHUB_OUTPUT
 
+      - name: Extract changelog entry
+        run: |
+          VERSION="${{ steps.verify.outputs.version }}"
+          awk -v v="## [$VERSION]" '$0==v{f=1;next} /^## \[/{f=0} f' CHANGELOG.md > RELEASE_NOTES.md
+          if ! grep -q '[^[:space:]]' RELEASE_NOTES.md; then
+            echo "CHANGELOG.md has no entry for ## [$VERSION]" >&2
+            exit 1
+          fi
+
       - name: Typecheck
         run: npm run typecheck
 
@@ -77,6 +86,7 @@ jobs:
         with:
           tag_name: v${{ steps.verify.outputs.version }}
           name: v${{ steps.verify.outputs.version }}
+          body_path: RELEASE_NOTES.md
           generate_release_notes: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to `toolception` are listed here. Versions follow [semver](https://semver.org/); while the major version is 0, a minor bump can contain breaking changes.
+
+Releases before 0.7.0 are described in [GitHub Releases](https://github.com/code-rabi/toolception/releases).
+
+## [0.7.0]
+
+### Breaking
+
+- In STATIC mode every client now gets its own `McpServer` and orchestrator, like DYNAMIC mode. Module loaders run once per client instead of once per process, with each client's merged session context. ([#27](https://github.com/code-rabi/toolception/pull/27))
+  - **Migration:** anything you register on the server returned by `createMcpServer` after it is created (prompts, resources, extra tools) no longer reaches STATIC clients. Register it inside your `createServer` factory instead, so every per-client server gets it.
+
+### Fixed
+
+- STATIC mode supports concurrent clients. Before, a second client's `initialize` closed the first client's connection, and its next request failed with `Session not found or expired`. ([#27](https://github.com/code-rabi/toolception/pull/27))
+- Per-session context (`?config=`) now reaches module loaders in STATIC mode. ([#27](https://github.com/code-rabi/toolception/pull/27))
+- Tools defined with a JSON Schema `inputSchema` load and receive their arguments on MCP SDK 1.28+, which rejects plain JSON Schema objects. ([#25](https://github.com/code-rabi/toolception/pull/25))
+
+### Changed
+
+- Now depends on `@modelcontextprotocol/sdk` `^1.32.1` and `fastify` `^5.12.5`. ([#25](https://github.com/code-rabi/toolception/pull/25))
+- The `zod` dependency floor is now `^3.25`, matching the MCP SDK's peer range. ([#26](https://github.com/code-rabi/toolception/pull/26))
+- Every tool, meta-tools included, registers through `McpServer.registerTool` instead of the deprecated `server.tool()` overloads. `annotations.title` is also sent as the tool's top-level `title`. ([#26](https://github.com/code-rabi/toolception/pull/26))
+- JSON Schema inputs are accepted but not advertised to clients; use Zod shapes to advertise a tool's parameters. ([#25](https://github.com/code-rabi/toolception/pull/25), [#26](https://github.com/code-rabi/toolception/pull/26))
+
+### Security
+
+- Patched vulnerable dependencies: MCP SDK (GHSA-6qxp-vccf-f47h), fastify, and transitive packages (proxy-addr, hono, path-to-regexp, qs, fast-uri, ip-address). Dev tooling moved to vitest 5. ([#25](https://github.com/code-rabi/toolception/pull/25))

package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolception",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",
@@ -9,6 +9,7 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {