diff --git a/.changeset/4162-filesystem-bounded-walk.md b/.changeset/4162-filesystem-bounded-walk.md
deleted file mode 100644
index f9eb55dd8a..0000000000
--- a/.changeset/4162-filesystem-bounded-walk.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-`search_files`, `directory_tree` and path validation no longer hang on slow provider-backed folders (macOS CloudStorage, iCloud Drive, slow network mounts). Each `realpath` and recursive `readdir` now waits at most 15 seconds and then fails the request with an error naming the path; a path whose realpath times out is refused. `search_files` and `directory_tree` stop with an error after visiting 100,000 entries. `search_files` now applies `excludePatterns` before resolving an entry, so an excluded folder is never touched.
diff --git a/.changeset/470-filesystem-case-respelling.md b/.changeset/470-filesystem-case-respelling.md
deleted file mode 100644
index 7f6d2150cd..0000000000
--- a/.changeset/470-filesystem-case-respelling.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-A path that spells an allowed directory's own name in a letter case matching neither the configured nor the on-disk spelling (for example `C:\Work\CASETEST\file.txt` for an allowed `C:\Work\CaseTest`) is no longer refused on a case-insensitive file system (Windows NTFS, default macOS APFS). The request is mapped onto the allowed directory only where the file system confirms, component by component, that both spellings name one entry, so a sibling directory differing only in case is still refused on a case-sensitive directory.
diff --git a/.changeset/5154-filesystem-bigint-identity.md b/.changeset/5154-filesystem-bigint-identity.md
deleted file mode 100644
index 62fc36217a..0000000000
--- a/.changeset/5154-filesystem-bigint-identity.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-`write_file` and `edit_file` compare the file they opened against the one they checked as BigInt stats, so a Windows file id above 2^53 is compared exactly rather than rounded. Where a path-based stat on Windows reports no device (libuv < 1.51.0, the Node 23 line), the overwrite no longer refuses every existing file: the file must instead match on inode, size and modification time, and any difference still refuses.
diff --git a/.changeset/5183-filesystem-root-advertised-form.md b/.changeset/5183-filesystem-root-advertised-form.md
deleted file mode 100644
index da4d51cd72..0000000000
--- a/.changeset/5183-filesystem-root-advertised-form.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-A client Root is now allowed in the form the client advertised it as well as in its resolved form, as command-line directories already were. A request that names a path through a symlinked Root's own spelling (for example `/tmp/...` for a Root of `file:///tmp/...` on macOS) is no longer refused, and `list_allowed_directories` lists both forms. Every request is still resolved and checked against the resolved directory, so a symlink inside a Root that points outside it stays refused.
diff --git a/.changeset/5185-filesystem-realpath-retry.md b/.changeset/5185-filesystem-realpath-retry.md
deleted file mode 100644
index fbb6650763..0000000000
--- a/.changeset/5185-filesystem-realpath-retry.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-A Root or command-line directory whose `realpath` fails once is now retried after a short delay instead of being lost for the life of the process. On Windows the first native `realpath` right after `subst` maps a drive can fail before the mapping is visible; a Root was dropped as inaccessible, and a command-line directory lost its resolved spelling, so every request on the drive was refused.
diff --git a/.changeset/5187-filesystem-head-crlf.md b/.changeset/5187-filesystem-head-crlf.md
deleted file mode 100644
index afdf725cc5..0000000000
--- a/.changeset/5187-filesystem-head-crlf.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-`read_text_file` with `head` no longer leaves a `\r` at the end of each line of a CRLF file. Like `tail`, it returns lines normalized to LF, including a `\r\n` pair split across a read chunk. LF output is unchanged.
diff --git a/.changeset/5187-filesystem-tail-trailing-newline.md b/.changeset/5187-filesystem-tail-trailing-newline.md
deleted file mode 100644
index 7486a45b88..0000000000
--- a/.changeset/5187-filesystem-tail-trailing-newline.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-`read_text_file` with `tail` no longer returns one line too few when the file ends with a newline: the final newline ends the last line instead of counting as an empty one, for LF and CRLF files and for files longer than one read chunk. Like `head`, the result carries no trailing newline.
diff --git a/.changeset/5188-filesystem-move-exdev.md b/.changeset/5188-filesystem-move-exdev.md
deleted file mode 100644
index c6f35e65c9..0000000000
--- a/.changeset/5188-filesystem-move-exdev.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": patch
----
-
-`move_file` now moves a regular file between allowed directories on different filesystems (mounts, disks or shares), where it used to fail with `EXDEV`: it copies the file to a newly created destination, keeping its permissions and modification time, then removes the source, and removes a partial copy if anything fails. A directory still cannot be moved across filesystems, and now fails with an error that says so.
diff --git a/.changeset/5226-filesystem-hard-link-count.md b/.changeset/5226-filesystem-hard-link-count.md
deleted file mode 100644
index 5878f196be..0000000000
--- a/.changeset/5226-filesystem-hard-link-count.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-filesystem": minor
----
-
-`get_file_info` now reports a file's hard-link count as a `hardLinks: <n>` line, after `permissions`, so a client can see that a file has other names before changing it. The README now says that allowed-directory checks are path-based, and that overwriting or editing a file that is hard-linked from elsewhere changes it at every name ([#5226](https://github.com/modelcontextprotocol/servers/issues/5226)).
diff --git a/.changeset/elicitation-summary-fields.md b/.changeset/elicitation-summary-fields.md
deleted file mode 100644
index 2130f1ad69..0000000000
--- a/.changeset/elicitation-summary-fields.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-everything": patch
----
-
-`trigger-elicitation-request` now summarizes an accepted form by the fields the form actually asks for: it lists the favorite first line and the five enum fields, and no longer reports `color` or `petType`, which the form never defined.
diff --git a/.changeset/everything-gzip-http-error-status.md b/.changeset/everything-gzip-http-error-status.md
deleted file mode 100644
index e6ce48e883..0000000000
--- a/.changeset/everything-gzip-http-error-status.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-everything": patch
----
-
-`gzip-file-as-resource` now fails with an error naming the URL and HTTP status when the fetch returns a non-2xx response, instead of gzipping the error page as the file.
diff --git a/.changeset/everything-resource-links-naming.md b/.changeset/everything-resource-links-naming.md
deleted file mode 100644
index 5081e20428..0000000000
--- a/.changeset/everything-resource-links-naming.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-everything": patch
----
-
-`get-resource-links`: rename the misleading `isOdd` flag to `isText`, and say in its JSDoc and in `docs/features.md` that even IDs are Text resources and odd IDs are Blob resources. The JSDoc headers of `get-resource-links` and `trigger-long-running-operation` now name the tool their file registers. No behavior change.
diff --git a/.changeset/everything-tiny-image-crc.md b/.changeset/everything-tiny-image-crc.md
deleted file mode 100644
index 434ac872e5..0000000000
--- a/.changeset/everything-tiny-image-crc.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-everything": patch
----
-
-`get-tiny-image` (and `get-annotated-message`'s image) now returns a fully valid PNG: the embedded logo's corrupt `iCCP` color-profile chunk, whose CRC-32 did not match and which strict decoders rejected, is removed. The pixels are unchanged.
diff --git a/.changeset/get-env-mask-secrets.md b/.changeset/get-env-mask-secrets.md
deleted file mode 100644
index fe6f5ee5aa..0000000000
--- a/.changeset/get-env-mask-secrets.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-everything": minor
----
-
-`get-env` now masks the values of credential-like environment variables (names with a `KEY`, `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `AUTH` or `COOKIE` segment) as `"<redacted>"`. Set `GET_ENV_INCLUDE_SECRETS=1` to return every value unmasked.
diff --git a/.changeset/gzip-refuse-private-addresses.md b/.changeset/gzip-refuse-private-addresses.md
deleted file mode 100644
index 4394b68cb1..0000000000
--- a/.changeset/gzip-refuse-private-addresses.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-everything": minor
----
-
-`gzip-file-as-resource` now refuses to fetch from loopback, private, link-local (cloud metadata) and other non-public addresses, on the caller's URL and on every redirect hop, and applies `GZIP_ALLOWED_DOMAINS` to every hop too. Set `GZIP_ALLOW_PRIVATE_IPS=1` to fetch from a local or private origin as before.
diff --git a/.changeset/memory-migration-failure.md b/.changeset/memory-migration-failure.md
deleted file mode 100644
index 818200b2d4..0000000000
--- a/.changeset/memory-migration-failure.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-memory": patch
----
-
-A failed `memory.json` to `memory.jsonl` migration now stops startup with an error naming both paths and the cause, instead of being silently ignored and starting the server on an empty graph.
diff --git a/.changeset/memory-preserve-extra-fields.md b/.changeset/memory-preserve-extra-fields.md
deleted file mode 100644
index 136db565bb..0000000000
--- a/.changeset/memory-preserve-extra-fields.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@modelcontextprotocol/server-memory": patch
----
-
-Keep the fields the server does not model on stored entities and relations (a `createdAt` written by an older version or another client, say) when a write saves the graph. Before, every write dropped them from the memory file, even an empty `create_entities` call, so `create_entities`, `create_relations` and `add_observations` destroyed data despite declaring `destructiveHint: false`. A record a delete tool removes still goes with its fields, and the fields never appear in tool results.
diff --git a/package-lock.json b/package-lock.json
index f536b395f9..65623def4d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5612,7 +5612,7 @@
     },
     "src/everything": {
       "name": "@modelcontextprotocol/server-everything",
-      "version": "2.0.1",
+      "version": "2.1.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/node": "^2.1.1",
@@ -5642,7 +5642,7 @@
     },
     "src/filesystem": {
       "name": "@modelcontextprotocol/server-filesystem",
-      "version": "2.0.1",
+      "version": "2.1.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/server": "^2.3.1",
@@ -5670,7 +5670,7 @@
     },
     "src/memory": {
       "name": "@modelcontextprotocol/server-memory",
-      "version": "2.0.0",
+      "version": "2.0.1",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/server": "^2.3.1",
diff --git a/src/everything/CHANGELOG.md b/src/everything/CHANGELOG.md
index 38f53b65c8..44b065bcf5 100644
--- a/src/everything/CHANGELOG.md
+++ b/src/everything/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @modelcontextprotocol/server-everything
 
+## 2.1.0
+
+### Minor Changes
+
+- [#5293](https://github.com/modelcontextprotocol/servers/pull/5293) [`f0c74aa`](https://github.com/modelcontextprotocol/servers/commit/f0c74aac70ab45d22b7d9e9373cd09460ec3e82e) [@cliffhall](https://github.com/cliffhall) - `get-env` now masks the values of credential-like environment variables (names with a `KEY`, `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `AUTH` or `COOKIE` segment) as `"<redacted>"`. Set `GET_ENV_INCLUDE_SECRETS=1` to return every value unmasked.
+
+- [#5295](https://github.com/modelcontextprotocol/servers/pull/5295) [`344a4bd`](https://github.com/modelcontextprotocol/servers/commit/344a4bdf3914bebb514a8f27196aa96db2e3b828) [@cliffhall](https://github.com/cliffhall) - `gzip-file-as-resource` now refuses to fetch from loopback, private, link-local (cloud metadata) and other non-public addresses, on the caller's URL and on every redirect hop, and applies `GZIP_ALLOWED_DOMAINS` to every hop too. Set `GZIP_ALLOW_PRIVATE_IPS=1` to fetch from a local or private origin as before.
+
+### Patch Changes
+
+- [#5289](https://github.com/modelcontextprotocol/servers/pull/5289) [`d4a8eb0`](https://github.com/modelcontextprotocol/servers/commit/d4a8eb0dd8b889a047938a6be0783923dd174ff1) [@cliffhall](https://github.com/cliffhall) - `trigger-elicitation-request` now summarizes an accepted form by the fields the form actually asks for: it lists the favorite first line and the five enum fields, and no longer reports `color` or `petType`, which the form never defined.
+
+- [#5290](https://github.com/modelcontextprotocol/servers/pull/5290) [`81a1e63`](https://github.com/modelcontextprotocol/servers/commit/81a1e63b261fbe169e7f729aeca0a392b473ded8) [@cliffhall](https://github.com/cliffhall) - `gzip-file-as-resource` now fails with an error naming the URL and HTTP status when the fetch returns a non-2xx response, instead of gzipping the error page as the file.
+
+- [#5297](https://github.com/modelcontextprotocol/servers/pull/5297) [`9130496`](https://github.com/modelcontextprotocol/servers/commit/9130496ad3a64483d4bd9414111327b1dea39fb0) [@cliffhall](https://github.com/cliffhall) - `get-resource-links`: rename the misleading `isOdd` flag to `isText`, and say in its JSDoc and in `docs/features.md` that even IDs are Text resources and odd IDs are Blob resources. The JSDoc headers of `get-resource-links` and `trigger-long-running-operation` now name the tool their file registers. No behavior change.
+
+- [#5298](https://github.com/modelcontextprotocol/servers/pull/5298) [`e220d44`](https://github.com/modelcontextprotocol/servers/commit/e220d444a304630db4eb5acb240a6afc72d220ab) [@cliffhall](https://github.com/cliffhall) - `get-tiny-image` (and `get-annotated-message`'s image) now returns a fully valid PNG: the embedded logo's corrupt `iCCP` color-profile chunk, whose CRC-32 did not match and which strict decoders rejected, is removed. The pixels are unchanged.
+
 ## 2.0.1
 
 ### Patch Changes
diff --git a/src/everything/package.json b/src/everything/package.json
index 46bef3411d..77dac768bb 100644
--- a/src/everything/package.json
+++ b/src/everything/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/server-everything",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "MCP server that exercises all the features of the MCP protocol",
   "license": "SEE LICENSE IN LICENSE",
   "mcpName": "io.github.modelcontextprotocol/server-everything",
diff --git a/src/filesystem/CHANGELOG.md b/src/filesystem/CHANGELOG.md
index 31a9aff280..6000a2b949 100644
--- a/src/filesystem/CHANGELOG.md
+++ b/src/filesystem/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @modelcontextprotocol/server-filesystem
 
+## 2.1.0
+
+### Minor Changes
+
+- [#5315](https://github.com/modelcontextprotocol/servers/pull/5315) [`15f16b9`](https://github.com/modelcontextprotocol/servers/commit/15f16b9ff8ff68350f16dec80e4d2761dd05c9be) [@cliffhall](https://github.com/cliffhall) - `get_file_info` now reports a file's hard-link count as a `hardLinks: <n>` line, after `permissions`, so a client can see that a file has other names before changing it. The README now says that allowed-directory checks are path-based, and that overwriting or editing a file that is hard-linked from elsewhere changes it at every name ([#5226](https://github.com/modelcontextprotocol/servers/issues/5226)).
+
+### Patch Changes
+
+- [#5326](https://github.com/modelcontextprotocol/servers/pull/5326) [`f3e5d36`](https://github.com/modelcontextprotocol/servers/commit/f3e5d36819cf68cc732c66e854e4a83fc40bb2b0) [@cliffhall](https://github.com/cliffhall) - `search_files`, `directory_tree` and path validation no longer hang on slow provider-backed folders (macOS CloudStorage, iCloud Drive, slow network mounts). Each `realpath` and recursive `readdir` now waits at most 15 seconds and then fails the request with an error naming the path; a path whose realpath times out is refused. `search_files` and `directory_tree` stop with an error after visiting 100,000 entries. `search_files` now applies `excludePatterns` before resolving an entry, so an excluded folder is never touched.
+
+- [#5319](https://github.com/modelcontextprotocol/servers/pull/5319) [`b57b04c`](https://github.com/modelcontextprotocol/servers/commit/b57b04c479d87a312728378a321beab0c1baec64) [@cliffhall](https://github.com/cliffhall) - A path that spells an allowed directory's own name in a letter case matching neither the configured nor the on-disk spelling (for example `C:\Work\CASETEST\file.txt` for an allowed `C:\Work\CaseTest`) is no longer refused on a case-insensitive file system (Windows NTFS, default macOS APFS). The request is mapped onto the allowed directory only where the file system confirms, component by component, that both spellings name one entry, so a sibling directory differing only in case is still refused on a case-sensitive directory.
+
+- [#5325](https://github.com/modelcontextprotocol/servers/pull/5325) [`322dcf0`](https://github.com/modelcontextprotocol/servers/commit/322dcf02e79f9a2dc74a32dba1337a42dbf74e02) [@cliffhall](https://github.com/cliffhall) - `write_file` and `edit_file` compare the file they opened against the one they checked as BigInt stats, so a Windows file id above 2^53 is compared exactly rather than rounded. Where a path-based stat on Windows reports no device (libuv < 1.51.0, the Node 23 line), the overwrite no longer refuses every existing file: the file must instead match on inode, size and modification time, and any difference still refuses.
+
+- [#5317](https://github.com/modelcontextprotocol/servers/pull/5317) [`d98c856`](https://github.com/modelcontextprotocol/servers/commit/d98c8566ef278a6caf802b7db8f647ca1e377981) [@cliffhall](https://github.com/cliffhall) - A client Root is now allowed in the form the client advertised it as well as in its resolved form, as command-line directories already were. A request that names a path through a symlinked Root's own spelling (for example `/tmp/...` for a Root of `file:///tmp/...` on macOS) is no longer refused, and `list_allowed_directories` lists both forms. Every request is still resolved and checked against the resolved directory, so a symlink inside a Root that points outside it stays refused.
+
+- [#5318](https://github.com/modelcontextprotocol/servers/pull/5318) [`dfe9187`](https://github.com/modelcontextprotocol/servers/commit/dfe9187334af83208a27ba871abc4d729e39685d) [@cliffhall](https://github.com/cliffhall) - A Root or command-line directory whose `realpath` fails once is now retried after a short delay instead of being lost for the life of the process. On Windows the first native `realpath` right after `subst` maps a drive can fail before the mapping is visible; a Root was dropped as inaccessible, and a command-line directory lost its resolved spelling, so every request on the drive was refused.
+
+- [#5324](https://github.com/modelcontextprotocol/servers/pull/5324) [`1002969`](https://github.com/modelcontextprotocol/servers/commit/1002969d59dc1e1a6e6754ecea7d12c689833c6d) [@cliffhall](https://github.com/cliffhall) - `read_text_file` with `head` no longer leaves a `\r` at the end of each line of a CRLF file. Like `tail`, it returns lines normalized to LF, including a `\r\n` pair split across a read chunk. LF output is unchanged.
+
+- [#5316](https://github.com/modelcontextprotocol/servers/pull/5316) [`30afc34`](https://github.com/modelcontextprotocol/servers/commit/30afc34bfcc851ed0175b727c45320de57c3fe6b) [@cliffhall](https://github.com/cliffhall) - `read_text_file` with `tail` no longer returns one line too few when the file ends with a newline: the final newline ends the last line instead of counting as an empty one, for LF and CRLF files and for files longer than one read chunk. Like `head`, the result carries no trailing newline.
+
+- [#5322](https://github.com/modelcontextprotocol/servers/pull/5322) [`f438a62`](https://github.com/modelcontextprotocol/servers/commit/f438a620a601cf5ed489cc476d93066573f8c4f2) [@cliffhall](https://github.com/cliffhall) - `move_file` now moves a regular file between allowed directories on different filesystems (mounts, disks or shares), where it used to fail with `EXDEV`: it copies the file to a newly created destination, keeping its permissions and modification time, then removes the source, and removes a partial copy if anything fails. A directory still cannot be moved across filesystems, and now fails with an error that says so.
+
 ## 2.0.1
 
 ### Patch Changes
diff --git a/src/filesystem/package.json b/src/filesystem/package.json
index d7206b9f2a..432fafe77c 100644
--- a/src/filesystem/package.json
+++ b/src/filesystem/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/server-filesystem",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "MCP server for filesystem access",
   "license": "SEE LICENSE IN LICENSE",
   "mcpName": "io.github.modelcontextprotocol/server-filesystem",
diff --git a/src/memory/CHANGELOG.md b/src/memory/CHANGELOG.md
index 599f0da6d2..97355c7e3a 100644
--- a/src/memory/CHANGELOG.md
+++ b/src/memory/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @modelcontextprotocol/server-memory
 
+## 2.0.1
+
+### Patch Changes
+
+- [#5291](https://github.com/modelcontextprotocol/servers/pull/5291) [`91d3745`](https://github.com/modelcontextprotocol/servers/commit/91d3745b9dd604c503e182aef19a9caaf85f0629) [@cliffhall](https://github.com/cliffhall) - A failed `memory.json` to `memory.jsonl` migration now stops startup with an error naming both paths and the cause, instead of being silently ignored and starting the server on an empty graph.
+
+- [#5292](https://github.com/modelcontextprotocol/servers/pull/5292) [`df743d4`](https://github.com/modelcontextprotocol/servers/commit/df743d41b076691c3aebc90bf1a0943e6935fcce) [@cliffhall](https://github.com/cliffhall) - Keep the fields the server does not model on stored entities and relations (a `createdAt` written by an older version or another client, say) when a write saves the graph. Before, every write dropped them from the memory file, even an empty `create_entities` call, so `create_entities`, `create_relations` and `add_observations` destroyed data despite declaring `destructiveHint: false`. A record a delete tool removes still goes with its fields, and the fields never appear in tool results.
+
 ## 2.0.0
 
 ### Major Changes
diff --git a/src/memory/package.json b/src/memory/package.json
index 286ab65df7..cb1ea6ae7f 100644
--- a/src/memory/package.json
+++ b/src/memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/server-memory",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "MCP server for enabling memory for Claude through a knowledge graph",
   "license": "SEE LICENSE IN LICENSE",
   "mcpName": "io.github.modelcontextprotocol/server-memory",