Ci/add pnpm setup by MrGDCrazy · Pull Request #1755 · modelcontextprotocol/typescript-sdk

MrGDCrazy · 2026-03-25T15:06:13Z

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

Added SDK Version Pin Agent documentation outlining its role, actions, scope, constraints, and examples for managing SDK dependencies across multiple repositories.

@v6

- CODEOWNERS: update auth-team paths to match v2 monorepo layout (old paths referenced /src/... which no longer exist, causing all auth-related PRs to skip required auth-team review) - ci: align actions/checkout and actions/setup-node to @v6 in the publish job of main.yml (was @v4, inconsistent with build/test jobs) - ci: add typecheck+lint gate to publish.yml before building preview packages (broken code could previously be published on every push) - ci: remove continue-on-error from conformance jobs; expected-failures is empty so real regressions were silently swallowed - security: remove internal error detail (String(error)) from the JSON-RPC parse-error response body in streamableHttp — stack traces and file paths should not be forwarded to clients - refactor: convert tasks/result polling handler from unbounded recursion to an explicit while-loop, eliminating deep promise-chain accumulation for long-running tasks https://claude.ai/code/session_01CCxV9DvdS7Bf7bck3R9FJs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add CodeQL analysis workflow configuration

Version Packages

changeset-bot · 2026-03-25T15:06:18Z

⚠️ No Changeset found

Latest commit: 04c55fe

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-03-25T15:08:30Z

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1755

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1755

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1755

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1755

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1755

commit: 04c55fe

Copilot

Pull request overview

This PR appears to prep the repo for a 2.0.0 release by updating package versions and generating package changelogs, while also tightening CI (pnpm checks, conformance gating) and making a couple of runtime-behavior hardening changes.

Changes:

Bump multiple workspace packages from 2.0.0-alpha.0 to 2.0.0 and add corresponding CHANGELOG.md files.
Update CI workflows (publish adds check:all, conformance is no longer continue-on-error) and add a CodeQL workflow.
Harden/adjust runtime behavior (remove raw parse error details from HTTP JSON-RPC error responses; replace recursive task result polling with an iterative loop).

Reviewed changes

Copilot reviewed 39 out of 39 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/integration/package.json	Version bump to `2.0.0` for integration test package.
test/integration/CHANGELOG.md	New changelog for `@modelcontextprotocol/test-integration` v2.0.0.
packages/server/src/server/streamableHttp.ts	Stops including raw parse error details in JSON-RPC error responses.
packages/server/package.json	Server package version bump to `2.0.0`.
packages/server/CHANGELOG.md	New changelog for `@modelcontextprotocol/server` v2.0.0.
packages/middleware/node/package.json	Node middleware version bump to `2.0.0`.
packages/middleware/node/CHANGELOG.md	New changelog for `@modelcontextprotocol/node` v2.0.0.
packages/middleware/hono/package.json	Hono middleware version bump to `2.0.0`.
packages/middleware/hono/CHANGELOG.md	New changelog for `@modelcontextprotocol/hono` v2.0.0.
packages/middleware/express/package.json	Express middleware version bump to `2.0.0`.
packages/middleware/express/CHANGELOG.md	New changelog for `@modelcontextprotocol/express` v2.0.0.
packages/core/src/shared/protocol.ts	Refactors `tasks/result` polling from recursion to an explicit loop.
packages/core/package.json	Core package version bump to `2.0.0`.
packages/core/CHANGELOG.md	New changelog for `@modelcontextprotocol/core` v2.0.0.
packages/client/package.json	Client package version bump to `2.0.0`.
packages/client/CHANGELOG.md	New changelog for `@modelcontextprotocol/client` v2.0.0.
.github/workflows/publish.yml	Adds `pnpm run check:all` before building/publishing.
.github/workflows/main.yml	Updates checkout/setup-node action versions.
.github/workflows/conformance.yml	Makes conformance failures block CI (`continue-on-error: false`).
.github/workflows/codeql.yml	Adds CodeQL scanning workflow (currently has YAML validity issues).
.github/agents/sdk-version-pin-agent.agent.md	Adds an agent spec doc for coordinating SDK version pinning across repos.
.github/CODEOWNERS	Updates auth-related ownership paths to match the `packages/` layout.
.changeset/use-scopes-supported-in-dcr.md	Removed changeset (presumably rolled into release changelogs).
.changeset/twelve-dodos-taste.md	Removed changeset (presumably rolled into release changelogs).
.changeset/tender-snails-fold.md	Removed changeset (presumably rolled into release changelogs).
.changeset/shy-times-learn.md	Removed changeset (presumably rolled into release changelogs).
.changeset/rich-hounds-report.md	Removed changeset (presumably rolled into release changelogs).
.changeset/respect-capability-negotiation.md	Removed changeset (presumably rolled into release changelogs).
.changeset/quick-islands-occur.md	Removed changeset (presumably rolled into release changelogs).
.changeset/oauth-error-http200.md	Removed changeset (presumably rolled into release changelogs).
.changeset/heavy-walls-swim.md	Removed changeset (presumably rolled into release changelogs).
.changeset/funky-baths-attack.md	Removed changeset (presumably rolled into release changelogs).
.changeset/fix-unknown-tool-protocol-error.md	Removed changeset (presumably rolled into release changelogs).
.changeset/fix-task-session-isolation.md	Removed changeset (presumably rolled into release changelogs).
.changeset/expose-auth-server-discovery.md	Removed changeset (presumably rolled into release changelogs).
.changeset/cyan-cycles-pump.md	Removed changeset (presumably rolled into release changelogs).
.changeset/busy-weeks-hang.md	Removed changeset (presumably rolled into release changelogs).
.changeset/brave-lions-glow.md	Removed changeset (presumably rolled into release changelogs).
.changeset/add-hono-peer-dep.md	Removed changeset (presumably rolled into release changelogs).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T15:12:27Z

.github/workflows/codeql.yml

+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Install pnpm
+      if: matrix.language == 'javascript-typescript'
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10.26.1
+        run_install: false
+
+    - name: Setup Node.js
+      if: matrix.language == 'javascript-typescript'
+      uses: actions/setup-node@v4
+      with:
+        node-version: 20
+        # ⚠️ No cache: 'pnpm' here — pnpm/action-setup handles caching
+
+    - name: Install dependencies
+      if: matrix.language == 'javascript-typescript'
+      run: pnpm install --frozen-lockfile
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+
+    - name: Run manual build steps
+      if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'Replace this with your manual build commands'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"


The steps: list items are not indented under steps, which makes this workflow invalid YAML (the - name: entries need to be nested under steps:). Please indent the step entries so they are children of steps:.

Suggested change

- name: Checkout repository

uses: actions/checkout@v4

- name: Install pnpm

if: matrix.language == 'javascript-typescript'

uses: pnpm/action-setup@v4

with:

version: 10.26.1

run_install: false

- name: Setup Node.js

if: matrix.language == 'javascript-typescript'

uses: actions/setup-node@v4

with:

node-version: 20

# ⚠️ No cache: 'pnpm' here — pnpm/action-setup handles caching

- name: Install dependencies

if: matrix.language == 'javascript-typescript'

run: pnpm install --frozen-lockfile

- name: Initialize CodeQL

uses: github/codeql-action/init@v4

with:

languages: ${{ matrix.language }}

build-mode: ${{ matrix.build-mode }}

- name: Run manual build steps

if: matrix.build-mode == 'manual'

shell: bash

run: |

echo 'Replace this with your manual build commands'

exit 1

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@v4

with:

category: "/language:${{matrix.language}}"

- name: Checkout repository

uses: actions/checkout@v4

- name: Install pnpm

if: matrix.language == 'javascript-typescript'

uses: pnpm/action-setup@v4

with:

version: 10.26.1

run_install: false

- name: Setup Node.js

if: matrix.language == 'javascript-typescript'

uses: actions/setup-node@v4

with:

node-version: 20

# ⚠️ No cache: 'pnpm' here — pnpm/action-setup handles caching

- name: Install dependencies

if: matrix.language == 'javascript-typescript'

run: pnpm install --frozen-lockfile

- name: Initialize CodeQL

uses: github/codeql-action/init@v4

with:

languages: ${{ matrix.language }}

build-mode: ${{ matrix.build-mode }}

- name: Run manual build steps

if: matrix.build-mode == 'manual'

shell: bash

run: |

echo 'Replace this with your manual build commands'

exit 1

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@v4

with:

category: "/language:${{matrix.language}}"

Copilot · 2026-03-25T15:12:27Z

.github/workflows/codeql.yml

+      uses: actions/setup-node@v4
+      with:
+        node-version: 20
+        # ⚠️ No cache: 'pnpm' here — pnpm/action-setup handles caching


This workflow currently doesn't configure dependency caching for pnpm (and the comment says pnpm/action-setup handles caching). If you want caching, add cache: pnpm (and cache-dependency-path) to actions/setup-node, or remove/adjust the comment to avoid implying caching is enabled when it isn't.

Suggested change

# ⚠️ No cache: 'pnpm' here — pnpm/action-setup handles caching

# Note: dependency caching is not configured here. To enable it, add cache: 'pnpm' and cache-dependency-path to actions/setup-node.

packages/server/package.json

MrGDCrazy and others added 10 commits March 24, 2026 22:03

Create SDK Version Pin Agent documentation

f0f4a47

Added SDK Version Pin Agent documentation outlining its role, actions, scope, constraints, and examples for managing SDK dependencies across multiple repositories.

Merge pull request #1 from MrGDCrazy/claude/audit-typescript-sdk-SuqNb

3686059

Add CodeQL analysis workflow configuration

e9847a7

Update .github/workflows/codeql.yml

2c26710

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge pull request #3 from MrGDCrazy/MrGDCrazy-patch-1

7452287

Add CodeQL analysis workflow configuration

Version Packages

5b2f621

Merge pull request #2 from MrGDCrazy/changeset-release/main

34c6729

Version Packages

fix: add pnpm setup to CodeQL workflow

554beb0

fix: remove cache pnpm from setup-node, let pnpm/action-setup handle it

64fcce1

MrGDCrazy requested a review from a team as a code owner March 25, 2026 15:06

Copilot AI review requested due to automatic review settings March 25, 2026 15:06

Copilot started reviewing on behalf of MrGDCrazy March 25, 2026 15:06 View session

Merge branch 'main' into ci/add-pnpm-setup

04c55fe

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ci/add pnpm setup#1755

Ci/add pnpm setup#1755
MrGDCrazy wants to merge 11 commits intomodelcontextprotocol:mainfrom
MrGDCrazy:ci/add-pnpm-setup

MrGDCrazy commented Mar 25, 2026

Uh oh!

changeset-bot bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	# ⚠️ No cache: 'pnpm' here — pnpm/action-setup handles caching
	# Note: dependency caching is not configured here. To enable it, add cache: 'pnpm' and cache-dependency-path to actions/setup-node.

Conversation

MrGDCrazy commented Mar 25, 2026

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Checklist

Additional context

Uh oh!

changeset-bot bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

pkg-pr-new bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot bot commented Mar 25, 2026 •

edited

Loading

pkg-pr-new bot commented Mar 25, 2026 •

edited

Loading