v2.3.0 — Stack Upgrade, GitHub API Expansion, MCP v2 Compliance

What's Changed

Stack Upgrades (0 vulnerabilities)

• Vitest 4.1.10 → 5.0.1 (fixes 3 moderate CVEs)
• @octokit/openapi-types 28 → 29, @octokit/types 17 → 18
• dotenv 17 → 18
• ai 7.0.58 → 7.0.109, @ai-sdk/* 4.0.x → latest
• zod 4.4.3 → 4.6.5, @biomejs/biome 2.5.7 → 2.5.14
• npm audit: 0 vulnerabilities

New GitHub API Tools (19 compound tools, 170+ actions)

• manage_workflows: list_workflows, trigger_dispatch, get_run, list_runs, get_run_logs, cancel_run
• manage_releases: create, list, get, update, delete, get_latest
• manage_branches: get_protection, update_protection, delete_protection, list_branches

MCP v2 Spec Compliance

• Resources (6): github://config, github://projects, github://sprints/current, github://milestones, github://agents, github://tools
• Prompts (6): review-prd, explain-task-complexity, suggest-issue-labels, analyze-sprint-risk, generate-release-notes, triage-issue
• Capabilities now declares tools + resources + prompts
• registerResources() extracted for testability (33 handler tests)

Runtime Fixes

• ConfidenceScorer cache bounded at 1000 entries (memory leak fix)
• AI tool errors return isError: true for non-AI failures
• Silent .catch(() => {}) in compound executors replaced with logged warnings
• AgentMetrics cold call: 101 API calls → 1 (listCommentsForRepo batch)
• RoadmapService: per-issue error handling prevents partial failure abort
• Biome: unsafeParameterDecoratorsEnabled fixes tsyringe decorator parsing

Tests

• 3061 tests, 121 suites pass, 0 failures
• 68 new tests this release (SecurityAuditLog, ToolTelemetry, WebhookServer, MCP Resources, MCP Prompts)

Full Changelog: v2.2.1...v2.3.0
npm: npm install mcp-github-project-manager@2.3.0