Version Packages (beta) (#2471)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

packages/middleware/express/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @modelcontextprotocol/express
 
+## 2.0.0-beta.3
+
+### Patch Changes
+
+- [#2420](https://github.com/modelcontextprotocol/typescript-sdk/pull/2420) [`7635115`](https://github.com/modelcontextprotocol/typescript-sdk/commit/7635115d0112c3f980b45a9773a4770660af8aae) Thanks [@felixweinberger](https://github.com/felixweinberger)! - Add runtime-neutral Bearer authentication to `@modelcontextprotocol/server`:
+  `requireBearerAuth` gates web-standard `fetch(request)` hosts (Cloudflare
+  Workers, Deno, Bun, Hono), built on the exported `verifyBearerToken` and
+  `bearerAuthChallengeResponse` pieces, with `OAuthTokenVerifier` now defined
+  here. The Express middleware adapts the same core and is unchanged in
+  behavior, except that `WWW-Authenticate` challenge values are now RFC 7235
+  quoted-string sanitized (quotes and backslashes escaped, control and
+  non-ASCII characters replaced); `@modelcontextprotocol/express` re-exports
+  `OAuthTokenVerifier` as before.
+
+- [#2422](https://github.com/modelcontextprotocol/typescript-sdk/pull/2422) [`61866d7`](https://github.com/modelcontextprotocol/typescript-sdk/commit/61866d7a5ff4475663ceb525c88447c497c1b92a) Thanks [@felixweinberger](https://github.com/felixweinberger)! - Add runtime-neutral OAuth discovery serving to `@modelcontextprotocol/server`:
+  `oauthMetadataResponse` serves the RFC 9728 Protected Resource Metadata and
+  RFC 8414 Authorization Server metadata documents from web-standard
+  `fetch(request)` hosts, built on the exported
+  `buildOAuthProtectedResourceMetadata`, with
+  `getOAuthProtectedResourceMetadataUrl` now defined here. The Express metadata
+  router adapts the same core and is unchanged in behavior; the insecure-issuer
+  escape hatch is an explicit `dangerouslyAllowInsecureIssuerUrl` option in the
+  neutral core instead of a module-scope environment read. The web-standard
+  matcher validates lazily so unmatched traffic always falls through, tolerates
+  a trailing slash, supports HEAD, and marks reflected CORS preflights with
+  `Vary`.
+- Updated dependencies [[`44797d7`](https://github.com/modelcontextprotocol/typescript-sdk/commit/44797d77792953d0ce70b68922bb6bb69e697c32), [`1b90c96`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1b90c96d11fd17016d2977cae9dd661de3fb84df), [`561c6d8`](https://github.com/modelcontextprotocol/typescript-sdk/commit/561c6d83456ef98d6c713bbda9837e64337f22c9), [`ce2f65d`](https://github.com/modelcontextprotocol/typescript-sdk/commit/ce2f65db0e019506f4d2526466ec8cc7106de98e), [`7e69735`](https://github.com/modelcontextprotocol/typescript-sdk/commit/7e697354de95111ca2c70a12ac9f5d3ec96b56c3), [`e8de519`](https://github.com/modelcontextprotocol/typescript-sdk/commit/e8de519d3129f46b7528d2999b7641f55be1f091), [`0ab5d14`](https://github.com/modelcontextprotocol/typescript-sdk/commit/0ab5d1471d6c7375878316df2930fca77eee1d2a), [`24be404`](https://github.com/modelcontextprotocol/typescript-sdk/commit/24be4040d454a9c5983901229068477c7a9ea796), [`7635115`](https://github.com/modelcontextprotocol/typescript-sdk/commit/7635115d0112c3f980b45a9773a4770660af8aae), [`61866d7`](https://github.com/modelcontextprotocol/typescript-sdk/commit/61866d7a5ff4475663ceb525c88447c497c1b92a)]:
+    - @modelcontextprotocol/server@2.0.0-beta.3
+
 ## 2.0.0-beta.2
 
 ### Patch Changes

packages/middleware/express/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@modelcontextprotocol/express",
     "private": false,
-    "version": "2.0.0-beta.2",
+    "version": "2.0.0-beta.3",
     "description": "Express adapters for the Model Context Protocol TypeScript server SDK - Express middleware",
     "license": "MIT",
     "author": "Anthropic, PBC (https://anthropic.com)",