Release v2.4.0 #5509

Activity

1. cliffhall

   added this to the v2.4.0 milestone on Nov 11, 2026
2. cliffhall

   added

   v2

   choreMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior changeMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior change

   on Nov 11, 2026
3. cliffhall commented on Nov 11, 2026

   

   cliffhall

   on Nov 11, 2026

   MemberAuthor

   More actions

   Release audit (step 2a)

   Audited at origin/v2/main 1c1ba9eb.

   Ecosystem	Scope	Result
   npm	root lockfile (all four TypeScript workspaces), npm audit --audit-level=high	found 0 vulnerabilities
   PyPI	mcp-server-fetch locked requirements, pip-audit --require-hashes	No known vulnerabilities found
   PyPI	mcp-server-git locked requirements	No known vulnerabilities found
   PyPI	mcp-server-time locked requirements	No known vulnerabilities found

   Every Python server was audited (verdict present for each). No fixes forced, so there is no audit PR.
4. cliffhall

   linked a pull request that will close this issuechore: version packages #5470on Nov 11, 2026
5. cliffhall

   linked a pull request that will close this issuechore: stamp Python CalVer versions for 2026.11.11 #5510on Nov 11, 2026
6. cliffhall

   self-assigned this

   on Nov 11, 2026
7. cliffhall commented on Nov 11, 2026

   

   cliffhall

   on Nov 11, 2026

   MemberAuthor

   More actions

   Release audit, re-run on the merge head

   Re-run at 6cfff622 (the merge PR #5518's head, the tree v2/main holds after the advisory fixes and both version PRs merged), because the first audit was at 1c1ba9eb.

   Ecosystem	Scope	Result
   npm	root lockfile, npm audit (all severity levels)	found 0 vulnerabilities
   PyPI	mcp-server-fetch, mcp-server-git, mcp-server-time locked requirements, pip-audit --require-hashes	No known vulnerabilities found (each)

   Every Python server was audited. Since 1c1ba9eb the lockfiles changed only in the packages' own version stamps (#5470, #5510) and an equivalent rewrite of the uv.lock resolution markers.

   Dependabot alert #331 (minimatch >=7.0.0 <11.0.1, moderate) is computed from main. The merge head resolves a single minimatch at 11.0.5, through the #5507 override, so the alert clears when this merge lands on main.
8. cliffhall

   closed this as completedon Nov 11, 2026