[dependabot]

This change reconciles the MCP package and private hosted artifact after a partial SDK upgrade left their reviewed source digests and advertised versions inconsistent. Both packages now pin client 2.3.0, node 2.1.1, server/core 2.3.0, and legacy SDK 1.31.0; nested-copy tests enforce that closure. The generator, independent verifier, bundle, notices, and license tests agree on the same dependency versions and complete upstream license text.

The branch includes current main at dba5c20. Its diff against main is limited to 12 MCP/dependency/artifact paths. Existing private-package publication guards and qualification flags remain enforced.

Validation on refreshed head 75ecaf4 (Windows, Node 24):

• MCP syntax/build checks; 62 tests passed, with one documented Windows SIGTERM skip. Both packed-consumer verifiers, package dry run, and 11/11 direct-bypass tests passed.
• Hosted artifact suite: 16/16 passed, zero skips. Ordinary rebuild, source verification, and pack dry run passed, with no tracked artifact drift.
• Both affected package audits reported zero vulnerabilities at the moderate threshold. Other repository advisories remain outside these package paths.
• Canonical integration count and capability projections passed. Rename-preflight generated content matches exactly after normalizing checkout CRLF to LF; the unmodified raw Windows checker reports that line-ending mismatch. Linux hosted validation remains the merge gate.
• Separate read-only source/dependency and supersession reviews found no actionable findings. All 24 exact-head hosted checks completed successfully: Validate Machine Surfaces 37983685935, Risk Fork 37983685949, and CodeQL 37983685959. Linux MCP tests passed 63/63 with zero skips, hosted artifact tests passed 16/16, and mandatory disposable PostgreSQL authority tests passed 70/70 with zero skips.

Reproduced hosted bundle SHA-256: fd5c4a92bd7708a2cf56669328972991fc951b61cff15e06cbc7172081e80896.

PR #446 was closed as superseded and contains no unique remaining changes: all five n8n paths are byte-identical to current main, its fixed transitive closure is carried forward, and current main retains newer SDK pins and renewed November 7 inventory holds. This PR supplies the remaining coordinated modern MCP update. Source validation does not establish private runtime qualification or authorize publication, deployment, provider trials, payments, or activation.

Merged at ba138b2 on October 9, 2026. Main's tree is identical to the reviewed candidate. All three post-merge workflows completed successfully: Validate Machine Surfaces 37984237062, Risk Fork 37984236975, and CodeQL 37984236941.

[rhein1]

Coordinated source-only MCP dependency repair

Reviewed head: 4fcff3f
Reviewed tree: aaf7bbc2c82cf4b22fcdd594a1c3d2ff78be151f
Parent: 8cd1c79
Base: deb37e1

The original hosted CI failure was reproduced locally: verify:source rejected the changed mcp/package.json digest. Re-running CI without repairing the reviewed source/artifact closure would not fix that failure.

This signed, normally fast-forwarded 12-path repair coordinates the versions proposed by #496, #497, and #498 in the MCP and hosted tooling: client 2.3.0, node 2.1.1, server/core 2.3.0. Legacy SDK 1.31.0, existing esbuild pins, optional E2B peer, publication guards, and default-off qualification flags are preserved. The other dependency PRs have not been closed or merged.

The established generator deliberately refreshed the reviewed source inventory and regenerated the bundle/notices/manifest. Ordinary builds and the independent verifier now reproduce the same artifact:

sha256:fd5c4a92bd7708a2cf56669328972991fc951b61cff15e06cbc7172081e80896

License tests require exact new core/server versions and declared Apache-2.0 records, complete upstream license text, byte counts, and hashes. Earlier MIT text and other required notices remain retained. Dependency tests reject mismatched nested modern SDK copies and runtime dependency promotion.

Local validation (Windows, Node 24.13.0):

• Locked installs with lifecycle scripts disabled for both affected packages.
• MCP syntax checks and complete suite: 62 passed, 1 documented Windows SIGTERM skip, 0 failures.
• Both MCP packed-consumer verifiers and MCP package dry run passed.
• Hosted syntax checks and complete artifact/adversarial suite: 16 passed, 0 skipped, 0 failures.
• Hosted ordinary build, artifact verification, independent source verification, and pack dry run passed. Rebuilding after explicit staging produced zero working-tree drift.
• Both package-specific npm audit checks at moderate threshold returned zero vulnerabilities. This is not a repository-wide vulnerability claim.
• Integration schema/count/status/machine-surface checks and documentation links passed. Windows checkout CRLF caused an initial raw rename-preflight mismatch; in-memory comparison proved unchanged semantic records and the canonical generator restored strict check success without a committed preflight diff.
• Scoped staged added-line secret/private-material matcher: 756 lines, zero findings; whitespace and exact 12-path staging checks passed. This is a bounded matcher, not universal secret assurance.
• Separate read-only source and tests/operations review contexts found no remaining actionable source finding. These are agent source reviews, not an independent human security assessment or an eligible GitHub approval.
• Commit signature verified locally and GitHub reports verified true, reason valid.

Automatic exact-head CI began on push: Risk Fork run 37635611625, CodeQL 37635611626, Validate Machine Surfaces 37635611687. Results, Linux matrix coverage, and mandatory disposable PostgreSQL/CA-TLS jobs remain pending at this checkpoint; prior-head CI is not substituted.

This is source/artifact maintenance only. No protected approval or merge, package publication, provider call, provider spend, cloud provisioning, deployment, canary, enrollment, or activation occurred. Production qualification and live traffic protection remain false; original operational gates are not closed by this change.

Final automatic CI checkpoint — 2026-10-07 14:26 UTC

GitHub freshly reports the exact reviewed head 4fcff3f with all 24 returned checks completed successfully. The three automatic runs above are completed successfully, including hosted-mcp-bundle, postgres-authority, managed-service Node 20/22/24, core/transaction/hackathon matrices, machine surfaces and CodeQL. The earlier pending checkpoint is retained as history; it is no longer the current CI status.

PR #498 remains OPEN, BLOCKED, REVIEW_REQUIRED. No eligible GitHub approval or merge occurred. The public worktree remains clean. The disposable public PostgreSQL CI jobs do not qualify private migration 115 or managed production PostgreSQL, and no operational gate is closed by these results.

Duplicate-candidate cleanup — 2026-10-07 14:41 UTC

PRs #496 and #497 were closed, not merged, as superseded by this exact coordinated head. Each complete two-path diff, current head, comments/reviews and checks was inspected; separate read-only source and test/operations review contexts found no unique work outside #498. Root rechecked both heads and #498's 24 successful checks immediately before closure. Main remains deb37e1; this source repair is not merged.

The close commands did not request branch deletion. Subsequent timelines show dependabot[bot] automatically deleted its duplicate head branch references. Exact original commits remain reachable remotely at refs/pull/496/head (b21d6f3) and refs/pull/497/head (7596d58). Both PR histories and all substantive dependency changes in #498 remain recoverable. The earlier branch-preservation wording in the closure comments was corrected after observing this automation. Dependabot will not repropose these exact closed releases unless reopened; future version notifications remain enabled and no ignore configuration was changed. No protected merge, provider, spend, deployment, publication or activation occurred.

[jmborden1112-beep]

LGTM

Needs Fixing

None identified in the refreshed source and artifact scope at 75ecaf4, based on current main dba5c20.

Requires Human Review

None remaining for this source maintenance. This is the solo maintainer's explicitly authorized second-account approval, not an independent human security assessment. Private host qualification and publication/deployment/provider/activation decisions remain outside this change.

Recommended Optional

None required for merge. All 24 exact-head hosted checks succeeded, including full machine validation, hosted artifact packaging, disposable PostgreSQL authority tests, and CodeQL.

Create Follow-up Issue

None created by this review. Existing operational gates and unrelated dependency advisories retain their separate scope.

Workflow Trace

Reviewed the coordinated exact MCP dependency closure, nested copies, source-digest and bundle reproducibility, full license notices, tests, documentation, default-off/private-package flags, and preservation of the current security fixes and inventory holds. Separate read-only review contexts covered PR498 and all 14 changed paths in PR446; the latter has no unique remaining contribution and was closed as superseded.

Coordinator: current Codex session; the requested Fable coordinator profile was not reconfigured or claimed. Review workers: requested gpt-5.6-luna is unavailable in this enabled collaboration runtime, so the explicit fallback was gpt-6-luna at medium reasoning. Root owned mutations, validation, commit, and hosted actions.

Local validation: MCP 62 passed / 1 documented Windows SIGTERM skip, hosted artifact 16/16 with zero skips, both packed-consumer checks, source verification, both package audits at zero vulnerabilities, direct-bypass tests 11/11, and no tracked rebuild drift. The Windows raw rename-preflight mismatch was verified to be CRLF only; the unchanged Linux hosted validate job succeeded.

Exact-head hosted workflows: Validate Machine Surfaces 37983685935, Risk Fork 37983685949, CodeQL 37983685959, all completed successfully. Signed refresh commit is GitHub-verified. Reproduced bundle SHA-256: fd5c4a92bd7708a2cf56669328972991fc951b61cff15e06cbc7172081e80896.