Merge branch 'v1/main' into fix/dns-rebinding-toctou-safeproxyfetch

.github/workflows/main.yml

@@ -2,7 +2,7 @@ on:
   push:
     branches:
       - main
-
+      - v1/main
   pull_request:
   release:
     types: [published]
@@ -69,6 +69,15 @@ jobs:
       - name: Ensure npm CLI supports OIDC trusted publishing
         run: npm install -g npm@^11.5.1
 
+      # `publish-all` pins `--tag v1-latest` on all four packages.
+      #
+      # Do NOT drop the flag: without an explicit tag npm assigns `latest`, so a
+      # v1 security release would drag `latest` back from v2 and every
+      # `npx @modelcontextprotocol/inspector` would silently get deprecated v1.
+      #
+      # Do NOT "simplify" the tag to `v1`: npm rejects any dist-tag that parses
+      # as a SemVer range, and `v1` does (`npm error Tag name must not be a
+      # valid SemVer range: v1`). That would fail the publish outright.
       - run: npm run publish-all
         env:
           NPM_CONFIG_PROVENANCE: "true"