[github-actions]

Part of #5330

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to v2/main, this PR will be updated.

Releases

@modelcontextprotocol/server-everything@2.1.0

Minor Changes

• #5293 f0c74aa @cliffhall - get-env now masks the values of credential-like environment variables (names with a KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH or COOKIE segment) as "<redacted>". Set GET_ENV_INCLUDE_SECRETS=1 to return every value unmasked.

• #5295 344a4bd @cliffhall - gzip-file-as-resource now refuses to fetch from loopback, private, link-local (cloud metadata) and other non-public addresses, on the caller's URL and on every redirect hop, and applies GZIP_ALLOWED_DOMAINS to every hop too. Set GZIP_ALLOW_PRIVATE_IPS=1 to fetch from a local or private origin as before.

Patch Changes

• #5289 d4a8eb0 @cliffhall - trigger-elicitation-request now summarizes an accepted form by the fields the form actually asks for: it lists the favorite first line and the five enum fields, and no longer reports color or petType, which the form never defined.

• #5290 81a1e63 @cliffhall - gzip-file-as-resource now fails with an error naming the URL and HTTP status when the fetch returns a non-2xx response, instead of gzipping the error page as the file.

• #5297 9130496 @cliffhall - get-resource-links: rename the misleading isOdd flag to isText, and say in its JSDoc and in docs/features.md that even IDs are Text resources and odd IDs are Blob resources. The JSDoc headers of get-resource-links and trigger-long-running-operation now name the tool their file registers. No behavior change.

• #5298 e220d44 @cliffhall - get-tiny-image (and get-annotated-message's image) now returns a fully valid PNG: the embedded logo's corrupt iCCP color-profile chunk, whose CRC-32 did not match and which strict decoders rejected, is removed. The pixels are unchanged.

@modelcontextprotocol/server-filesystem@2.1.0

Minor Changes

• #5315 15f16b9 @cliffhall - get_file_info now reports a file's hard-link count as a hardLinks: <n> line, after permissions, so a client can see that a file has other names before changing it. The README now says that allowed-directory checks are path-based, and that overwriting or editing a file that is hard-linked from elsewhere changes it at every name (#5226).

Patch Changes

• #5326 f3e5d36 @cliffhall - search_files, directory_tree and path validation no longer hang on slow provider-backed folders (macOS CloudStorage, iCloud Drive, slow network mounts). Each realpath and recursive readdir now waits at most 15 seconds and then fails the request with an error naming the path; a path whose realpath times out is refused. search_files and directory_tree stop with an error after visiting 100,000 entries. search_files now applies excludePatterns before resolving an entry, so an excluded folder is never touched.

• #5319 b57b04c @cliffhall - A path that spells an allowed directory's own name in a letter case matching neither the configured nor the on-disk spelling (for example C:\Work\CASETEST\file.txt for an allowed C:\Work\CaseTest) is no longer refused on a case-insensitive file system (Windows NTFS, default macOS APFS). The request is mapped onto the allowed directory only where the file system confirms, component by component, that both spellings name one entry, so a sibling directory differing only in case is still refused on a case-sensitive directory.

• #5325 322dcf0 @cliffhall - write_file and edit_file compare the file they opened against the one they checked as BigInt stats, so a Windows file id above 2^53 is compared exactly rather than rounded. Where a path-based stat on Windows reports no device (libuv < 1.51.0, the Node 23 line), the overwrite no longer refuses every existing file: the file must instead match on inode, size and modification time, and any difference still refuses.

• #5317 d98c856 @cliffhall - A client Root is now allowed in the form the client advertised it as well as in its resolved form, as command-line directories already were. A request that names a path through a symlinked Root's own spelling (for example /tmp/... for a Root of file:///tmp/... on macOS) is no longer refused, and list_allowed_directories lists both forms. Every request is still resolved and checked against the resolved directory, so a symlink inside a Root that points outside it stays refused.

• #5318 dfe9187 @cliffhall - A Root or command-line directory whose realpath fails once is now retried after a short delay instead of being lost for the life of the process. On Windows the first native realpath right after subst maps a drive can fail before the mapping is visible; a Root was dropped as inaccessible, and a command-line directory lost its resolved spelling, so every request on the drive was refused.

• #5324 1002969 @cliffhall - read_text_file with head no longer leaves a \r at the end of each line of a CRLF file. Like tail, it returns lines normalized to LF, including a \r\n pair split across a read chunk. LF output is unchanged.

• #5316 30afc34 @cliffhall - read_text_file with tail no longer returns one line too few when the file ends with a newline: the final newline ends the last line instead of counting as an empty one, for LF and CRLF files and for files longer than one read chunk. Like head, the result carries no trailing newline.

• #5322 f438a62 @cliffhall - move_file now moves a regular file between allowed directories on different filesystems (mounts, disks or shares), where it used to fail with EXDEV: it copies the file to a newly created destination, keeping its permissions and modification time, then removes the source, and removes a partial copy if anything fails. A directory still cannot be moved across filesystems, and now fails with an error that says so.

@modelcontextprotocol/server-memory@2.0.1

Patch Changes

• #5291 91d3745 @cliffhall - A failed memory.json to memory.jsonl migration now stops startup with an error naming both paths and the cause, instead of being silently ignored and starting the server on an empty graph.

• #5292 df743d4 @cliffhall - Keep the fields the server does not model on stored entities and relations (a createdAt written by an older version or another client, say) when a write saves the graph. Before, every write dropped them from the memory file, even an empty create_entities call, so create_entities, create_relations and add_observations destroyed data despite declaring destructiveHint: false. A record a delete tool removes still goes with its fields, and the fields never appear in tool results.

[cliffhall]

Part of #5330