modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore: pin v1 publishes to the v1 dist-tag (#1828)

Browse source 
`publish-all` had no `--tag`, so npm assigned `latest` to whatever it
published. That was correct for 1.0.1 — the deprecation release had to take
`latest` to reach npx users — but it becomes a trap the moment 2.0.0 ships: a
1.0.2 security fix published from `v1/main` would move `latest` back to v1, and
every `npx @modelcontextprotocol/inspector` in the world would silently get the
deprecated line.

`--tag v1` on both halves covers all four package names — `--workspaces` fans
out to inspector-client/-server/-cli, and the second invocation is the root.

Nothing enforces this flag, and the cost of dropping it surfaces months later
in a way that looks like an npm bug rather than a missing argument, so the
workflow carries a comment at the point of use.

Phase 3 of the v2 go-live runbook (#1804 §1).


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-07-27 21:47:46 -04:00 • committed by GitHub
commit 4f3e7fa167
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
package.json
View file

@ -47,7 +47,7 @@
"prettier-check": "prettier --check .",
"lint": "prettier --check . && cd client && npm run lint",
"prepare": "husky && npm run build",
"publish-all": "npm publish --workspaces --access public && npm publish --access public",
"publish-all": "npm publish --workspaces --access public --tag v1 && npm publish --access public --tag v1",
"update-version": "node scripts/update-version.js",
"check-version": "node scripts/check-version-consistency.js"
},