Milestone v2.3.0
The third v2/main → main milestone merge, cutting 2.3.0. This is step 2 of the release procedure in Cutting a release; step 1 (the version bump on v2/main) shipped in #2013 / #2052.
main currently holds 2.2.0 (merged via #1992 / #1993, plus one dependabot security bump that landed on main directly). Since then v2/main has accumulated 29 merged PRs (113 non-merge commits).
Scope
- Branch from
main, merge origin/v2/main.
- Open a PR against
main and run npm run ci green on the merged tree.
- After merge: tag
origin/main as bare 2.3.0 and draft the GitHub Release — publishing runs pack:verify, asserts the tag matches package.json, and publishes the latest dist-tag.
The version bump is not part of this issue — it already landed on v2/main (#2052), which is the whole point of the #2010 procedure change, and it arrives here as part of the payload.
Conflicts
Unlike the v2.2.0 merge, this one does conflict — main has moved since the last merge. #2004 (dependabot, npm_and_yarn group across 4 directories) landed on main only, so main is not an ancestor of v2/main. We will be addressing the dependabot PRs that target main instead of v2/main in the next release.
The security bumps from #2004 must survive the merge; verified in the root lockfile (hono 4.13.1, undici 8.9.0, body-parser 2.3.0, fast-uri 3.1.5, ip-address 10.5.0) and in the per-client lockfiles (cli: undici/fast-uri; tui: fast-uri; web: hono/fast-uri).
Payload highlights
| Group |
PRs |
| Release mechanics |
#2011 (sync v2/main to 2.2.0 + bump-before-merge guidance — #2010), #2052 (bump to 2.3.0 — #2013) |
| Windows support |
#1994 (eol=lf in .gitattributes), #1995 (process-wide SIGINT in the CLI suite), #1996 (TUI coverage flakes), #1997 (resolve node bins instead of spawning npx .cmd shims) |
| OAuth |
#2022 (per-server custom authorization-request parameters), #2037 (Auth/Token URL overrides), #2023 (surface and decode id_token), #2038 (correct the Custom Headers OAuth hint — #2040) |
| Protocol / runtime fixes |
#2016 (salvage a list result's valid entries — #1909), #2017 (gate connect-time logging/setLevel on the negotiated era — #1990), #2032 (read modern tasks support from the extension map), #2036 (CRLF-delimited SSE frames), #2045 (register SSE abort cleanup before the priming write), #2047 (surface list-fetch failures in paginated mode — #1998) |
| Forms / results |
#2014 (nullable and union argument fields, web + TUI — #1928), #2035 (RFC 6570 resource-template expansion — #1919), #2024 (gate submission on unsendable field text), #2027 (schema default reverting an edit in progress), #2034 (name an empty tool result — #1860), #2041 (duplicate tool names individually inspectable — #2001) |
| Container |
#2009 (bind loopback by address, pin the sandbox port) |
| Lint / tooling |
#2039 (no-floating-promises in all five scopes), #2029 (derive dep-lockstep candidates from what enters each tsc program), #2044 (ignore the web tsup build output in ESLint), #2050 (background command rejections — #2049), #2025 (pin JSON-editor escaping reproductions), #1976 (github-actions group bumps) |
Milestone v2.3.0
The third
v2/main→mainmilestone merge, cutting 2.3.0. This is step 2 of the release procedure in Cutting a release; step 1 (the version bump onv2/main) shipped in #2013 / #2052.maincurrently holds 2.2.0 (merged via #1992 / #1993, plus one dependabot security bump that landed onmaindirectly). Since thenv2/mainhas accumulated 29 merged PRs (113 non-merge commits).Scope
main, mergeorigin/v2/main.mainand runnpm run cigreen on the merged tree.origin/mainas bare2.3.0and draft the GitHub Release — publishing runspack:verify, asserts the tag matchespackage.json, and publishes thelatestdist-tag.The version bump is not part of this issue — it already landed on
v2/main(#2052), which is the whole point of the #2010 procedure change, and it arrives here as part of the payload.Conflicts
Unlike the v2.2.0 merge, this one does conflict —
mainhas moved since the last merge. #2004 (dependabot,npm_and_yarngroup across 4 directories) landed onmainonly, somainis not an ancestor ofv2/main. We will be addressing the dependabot PRs that targetmaininstead ofv2/mainin the next release.The security bumps from #2004 must survive the merge; verified in the root lockfile (hono 4.13.1, undici 8.9.0, body-parser 2.3.0, fast-uri 3.1.5, ip-address 10.5.0) and in the per-client lockfiles (cli: undici/fast-uri; tui: fast-uri; web: hono/fast-uri).
Payload highlights
v2/mainto 2.2.0 + bump-before-merge guidance — #2010), #2052 (bump to 2.3.0 — #2013)eol=lfin.gitattributes), #1995 (process-wide SIGINT in the CLI suite), #1996 (TUI coverage flakes), #1997 (resolve node bins instead of spawningnpx.cmdshims)id_token), #2038 (correct the Custom Headers OAuth hint — #2040)logging/setLevelon the negotiated era — #1990), #2032 (read modern tasks support from the extension map), #2036 (CRLF-delimited SSE frames), #2045 (register SSE abort cleanup before the priming write), #2047 (surface list-fetch failures in paginated mode — #1998)no-floating-promisesin all five scopes), #2029 (derive dep-lockstep candidates from what enters each tsc program), #2044 (ignore the web tsup build output in ESLint), #2050 (background command rejections — #2049), #2025 (pin JSON-editor escaping reproductions), #1976 (github-actions group bumps)