-
chore: 2.0.0 (#1842)
Some checks failedRun install, format, lint, build, and test on every push / build (push) Has been cancelledRun install, format, lint, build, and test on every push / publish (push) Has been cancelledRun install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelledreleased this
2026-07-28 03:17:31 -04:00 | 1284 commits to main since this releaseThe v2 go-live release (#1818, phase 5 of #1804).
This is byte-identical to 2.0.0-rc.3 apart from dropping the prerelease suffix,
which is what makes rc.3's validation meaningful: the tree that ships is the
tree that was validated against the live registry.2.0.0has no hyphen, so the derivation added in #1834 resolves it tolatest
— this is the release that takes the tag from 1.0.1.Validated across three release candidates:
- rc.1 caught two publish-path defects invisible to every local check —
NODE_AUTH_TOKENpointing at a non-existent secret (shadowing OIDC trusted
publishing) and a missing npm CLI upgrade (trusted publishing needs= 11.5.1; Node 22 bundles 10.x). Both fixed in #1836.
- rc.2 validated the dependency sweep (#1837) that cleared every prod-scope
advisory using lockfile-only changes. - rc.3 validated the vite 8.1.5 bump (#1841) closing three high-severity
dev-server file-read advisories.
Each RC was verified with a cold
node:22container install driving the
published tarball end to end — install,--help, and a real--cli tools/list
against a live stdio server.latestremained on 1.0.1 throughout, proving the
--tagderivation.Zero open Dependabot alerts at time of release.
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
Co-authored-by: Claude Opus 5 (1M context) noreply@anthropic.com
Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- rc.1 caught two publish-path defects invisible to every local check —