v2.0.0 — MCP SDK v2 dependency major (wire protocol unchanged)

BREAKING (dependency)

• Runtime moved from @modelcontextprotocol/sdk@1.x to @modelcontextprotocol/{server,core}@2.x.
  Breaking for anything resolving alongside this package. npm had been serving the previous version
  against SDK 1.x while main ran 2.x.

This is NOT a protocol change

The negotiated MCP wire revision is 2025-11-25 before and after. Verified by a live stdio
round trip against the shipped bundle/index.cjs — the exact file .mcp.json launches, not the
source — which reports version 2.0.0, negotiates 2025-11-25, lists 3 tools (fuzzy_search_files, fuzzy_filter, fuzzy_search_content), and returns
-32601 for a bogus method so the probe is known failure-capable.

The v2 package major and the protocol era are separate facts. A sibling repo in this sweep
declared a protocol revision no published SDK implements, and releasing it under an "MCP 2.0"
framing would have put a false claim in front of consumers. Neither this repo nor its sibling
hardcodes a protocol version.

Version bumped in four places

This repo hardcodes its version rather than reading package.json at runtime, so the bump covers
package.json, index.js, bundle/index.cjs, and .claude-plugin/plugin.json. Bumping only the
manifest would have shipped an artifact reporting the old version and left the version-keyed
plugin cache serving the previous directory.

v1.3.0 — companion skill + binary-planting hardening

Rolls up two gaps. The companion skill (fzf-mcp:fzf, /fzf) had been reserved
as 1.2.0 in the plugin manifest and marketplace since 2026-07-06 but never
made it into package.json, a git tag, or npm. This release carries it
forward together with real security hardening added since:

• Resolve the fzf binary, findstr, and archive extraction to absolute paths
  only — closes a CWE-426/427 binary-planting exposure on Windows where
  CreateProcess searches the CWD before PATH.
• Archive extraction now uses System32 bsdtar instead of PowerShell
  Expand-Archive, which fails to load on some Windows hosts.
• @hono/node-server forced to >=2.0.5 (Dependabot #29, path traversal).
• Windows CI leg added — this server's production platform had never been
  tested in CI.

Full detail in CHANGELOG.md.