• 2.0.0 7aebf168e6

    chore: 2.0.0 (#1842)
    Some checks failed
    Run install, format, lint, build, and test on every push / build (push) Has been cancelled
    Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
    Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled

    Ghost released this 2026-07-28 03:17:31 -04:00 | 1284 commits to main since this release

    The v2 go-live release (#1818, phase 5 of #1804).

    This is byte-identical to 2.0.0-rc.3 apart from dropping the prerelease suffix,
    which is what makes rc.3's validation meaningful: the tree that ships is the
    tree that was validated against the live registry.

    2.0.0 has no hyphen, so the derivation added in #1834 resolves it to latest
    — this is the release that takes the tag from 1.0.1.

    Validated across three release candidates:

    • rc.1 caught two publish-path defects invisible to every local check —
      NODE_AUTH_TOKEN pointing at a non-existent secret (shadowing OIDC trusted
      publishing) and a missing npm CLI upgrade (trusted publishing needs

      = 11.5.1; Node 22 bundles 10.x). Both fixed in #1836.

    • rc.2 validated the dependency sweep (#1837) that cleared every prod-scope
      advisory using lockfile-only changes.
    • rc.3 validated the vite 8.1.5 bump (#1841) closing three high-severity
      dev-server file-read advisories.

    Each RC was verified with a cold node:22 container install driving the
    published tarball end to end — install, --help, and a real --cli tools/list
    against a live stdio server. latest remained on 1.0.1 throughout, proving the
    --tag derivation.

    Zero open Dependabot alerts at time of release.

    Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

    Co-authored-by: Claude Opus 5 (1M context) noreply@anthropic.com

    Downloads