Skip to content

release: promote audited MCP SDK graph to production - #5

Merged
sjungwon03 merged 2 commits into
mainfrom
dev
Jul 28, 2026
Merged

release: promote audited MCP SDK graph to production#5
sjungwon03 merged 2 commits into
mainfrom
dev

Conversation

@sjungwon03

@sjungwon03 sjungwon03 commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

Promote the reviewed examples-application MCP SDK audit mitigation from dev to release-only main.

Exact source

  • Dev head: 3155e9cb56d845aa54bb6819eac9cf28548be993
  • Lockfile resolution: @modelcontextprotocol/sdk@1.30.0 and @hono/node-server@2.0.12
  • Scope: examples application only; this does not remedy downstream TypeMCP consumer graphs.
  • Upstream package remediation remains tracked in Theorvane/type-mcp#93.

Required verification

  • Exact-head verify and release-promotion checks
  • Fresh independent approval and resolved review threads
  • npm audit --omit=dev --audit-level=low clean at production commit

Closes #4

@sjungwon03 sjungwon03 added release Dev-to-main release promotion dependencies Dependency management security Security remediation labels Jul 28, 2026
@sjungwon03 sjungwon03 self-assigned this Jul 28, 2026
@sjungwon03
sjungwon03 requested a review from sjungwon03-ai July 28, 2026 17:39
sjungwon03-ai
sjungwon03-ai approved these changes Jul 28, 2026
View reviewed changes

@sjungwon03-ai sjungwon03-ai left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Independent release-promotion review at exact head 3155e9c. Override scope, lockfile pins (SDK 1.30.0 / Hono 2.0.12), CI gates, README boundary statement, labels, and no-regression all verified.

Comment thread package.json
Comment thread test/dependency-security.test.ts
Comment thread README.md
Comment thread .github/workflows/release-promotion.yml
@sjungwon03
sjungwon03 merged commit 59cff94 into main Jul 28, 2026
3 checks passed
@sjungwon03 sjungwon03 mentioned this pull request Jul 28, 2026
Closed
@sjungwon03-ai sjungwon03-ai mentioned this pull request Jul 29, 2026
Closed
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
chore: reconcile main release history into dev (#11)
eff78ed 
* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote TypeMCP 0.2.2 examples remediation (#14)
3d07fa8 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote Swagger Petstore examples (#20)
a74b30a 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

* feat: add read-only Swagger Petstore agent examples (#16)

* docs(planning): add Swagger Petstore agent plan

* feat: add read-only Swagger Petstore client

* feat: wrap read-only Petstore API in TypeMCP

* feat: add TypeChain Petstore agent workflow

* feat: add live Swagger Petstore demonstrations

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote real TypeChain Petstore agent (#26)
3ef010f 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

* feat: add read-only Swagger Petstore agent examples (#16)

* docs(planning): add Swagger Petstore agent plan

* feat: add read-only Swagger Petstore client

* feat: wrap read-only Petstore API in TypeMCP

* feat: add TypeChain Petstore agent workflow

* feat: add live Swagger Petstore demonstrations

* feat: add real TypeChain Petstore agent factory (#22)

* docs(planning): define real Petstore agent delivery

* feat: add real TypeChain Petstore agent factory

* docs: explain application-owned Petstore agent runtime

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote Petstore MCP HTTP agent example (#32)
0fc09cc 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

* feat: add read-only Swagger Petstore agent examples (#16)

* docs(planning): add Swagger Petstore agent plan

* feat: add read-only Swagger Petstore client

* feat: wrap read-only Petstore API in TypeMCP

* feat: add TypeChain Petstore agent workflow

* feat: add live Swagger Petstore demonstrations

* feat: add real TypeChain Petstore agent factory (#22)

* docs(planning): define real Petstore agent delivery

* feat: add real TypeChain Petstore agent factory

* docs: explain application-owned Petstore agent runtime

* refactor: build Petstore TypeMCP HTTP agent example (#28)

* docs: design real Petstore MCP agent example

* docs(planning): detail Petstore MCP agent rewrite

* feat: add loopback Petstore MCP runtime and client

* feat: add TypeChain Petstore MCP agent

* refactor: center examples on Petstore MCP agent

* ci: verify Petstore MCP fixtures

---------

Co-authored-by: sjungwon03 <>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sjungwon03-ai sjungwon03-ai sjungwon03-ai approved these changes

Assignees

@sjungwon03 sjungwon03

Labels

dependencies Dependency management release Dev-to-main release promotion security Security remediation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sjungwon03 @sjungwon03-ai