Changelog

All notable changes to this project will be documented in this file.

Bug Fixes

• Use publish:true instead of draft:false to auto-publish releases

• Implement two-phase release workflow

• Apply research-based fixes

• Implement two-phase release workflow (#493)

• Restore package-lock.json and pin ip-address 10.5.1 (#496)

• Require npm >= 11 in deps-check and ignore scratch dirs in eslint (#497)

• Clear scorecard dependency advisories

• Clear scorecard dependency advisories (#513)

• Sync lockfile and SPDX headers to GPL-2.0-or-later

• Load hashing_perceptual.js in the fingerprint command (#515)

• Stop passing tool names through a shell (#521)

• Add footer classic mode translations (#520)

• Pin patched katex 0.18.2 and smol-toml 1.9.0 overrides (#531)

• Resolve npm audit root advisories and document braces exception (#533)

• Let security audit reach the policy gate when npm finds vulns (#534)

• Detect first-time contributors in welcome workflow (#536)

• Skip write-only PR bots on fork pull requests (#538)

• Configure eslint for DOM types and CDN imports (#537)

CI/CD

• Skip the request-info bot on good-first-issue tasks

• Skip the request-info bot on good-first-issue tasks (#512)

• Keep depcheck and size label green on fork PRs (#522)

• Add no-API issue hygiene workflows (#529)

• Fix release-event workflow failures (#542)

• Wire NPM_TOKEN into the stage step (#543)

• Add welcome, release-announce, and digest bots (#545)

• Add update fallback and welcome dispatch test (#549)

Chores

• Bump the dev-dependencies group with 15 updates (#494)

• Bump the github-actions group with 10 updates (#495)

• Add .editorconfig mirroring .gitattributes line-ending policy

• Add full GPL-2.0 text, code of conduct, issue config, labels

• Contribution readiness — full GPL-2.0 text, CoC, issue config, discovery labels (#499)

• Restore lockfile libc metadata stripped on Windows

• Align package.json license with LICENSE text

• Align package.json license with GPL-2.0-or-later (#514)

• Bump the dev-dependencies group with 10 updates (#516)

• Bump the production-dependencies group across 1 directory with 2 updates (#517)

• Bump the github-actions group with 6 updates (#518)

• Prepare package for npm publication (#519)

• Bump the security group across 1 directory with 3 updates (#530)

• Bump @modelcontextprotocol/sdk from 1.30.0 to 1.32.1 in the security group across 1 directory (#539)

• Align ignoreDependencies with depcheck ignore policy (#540)

• Untrack root tests/ scratch directory (#544)

Documentation

• Refresh docs for the v2.0.0 release (#541)