Repository navigation
Release 2.3.0 step 2: Merge v2/main into main and cut releease #2053
Description
Milestone v2.3.0
The third v2/main → main milestone merge, cutting 2.3.0. This is step 2 of the release procedure in Cutting a release; step 1 (the version bump on v2/main) shipped in #2013 / #2052.
main currently holds 2.2.0 (merged via #1992 / #1993, plus one dependabot security bump that landed on main directly). Since then v2/main has accumulated 29 merged PRs (113 non-merge commits).
Scope
- Branch from
main, mergeorigin/v2/main. - Open a PR against
mainand runnpm run cigreen on the merged tree. - After merge: tag
origin/mainas bare2.3.0and draft the GitHub Release — publishing runspack:verify, asserts the tag matchespackage.json, and publishes thelatestdist-tag.
The version bump is not part of this issue — it already landed on v2/main (#2052), which is the whole point of the #2010 procedure change, and it arrives here as part of the payload.
Conflicts
Unlike the v2.2.0 merge, this one does conflict — main has moved since the last merge. #2004 (dependabot, npm_and_yarn group across 4 directories) landed on main only, so main is not an ancestor of v2/main. We will be addressing the dependabot PRs that target main instead of v2/main in the next release.
The security bumps from #2004 must survive the merge; verified in the root lockfile (hono 4.13.1, undici 8.9.0, body-parser 2.3.0, fast-uri 3.1.5, ip-address 10.5.0) and in the per-client lockfiles (cli: undici/fast-uri; tui: fast-uri; web: hono/fast-uri).
Payload highlights
| Group | PRs |
|---|---|
| Release mechanics | #2011 (sync v2/main to 2.2.0 + bump-before-merge guidance — #2010), #2052 (bump to 2.3.0 — #2013) |
| Windows support | #1994 (eol=lf in .gitattributes), #1995 (process-wide SIGINT in the CLI suite), #1996 (TUI coverage flakes), #1997 (resolve node bins instead of spawning npx .cmd shims) |
| OAuth | #2022 (per-server custom authorization-request parameters), #2037 (Auth/Token URL overrides), #2023 (surface and decode id_token), #2038 (correct the Custom Headers OAuth hint — #2040) |
| Protocol / runtime fixes | #2016 (salvage a list result's valid entries — #1909), #2017 (gate connect-time logging/setLevel on the negotiated era — #1990), #2032 (read modern tasks support from the extension map), #2036 (CRLF-delimited SSE frames), #2045 (register SSE abort cleanup before the priming write), #2047 (surface list-fetch failures in paginated mode — #1998) |
| Forms / results | #2014 (nullable and union argument fields, web + TUI — #1928), #2035 (RFC 6570 resource-template expansion — #1919), #2024 (gate submission on unsendable field text), #2027 (schema default reverting an edit in progress), #2034 (name an empty tool result — #1860), #2041 (duplicate tool names individually inspectable — #2001) |
| Container | #2009 (bind loopback by address, pin the sandbox port) |
| Lint / tooling | #2039 (no-floating-promises in all five scopes), #2029 (derive dep-lockstep candidates from what enters each tsc program), #2044 (ignore the web tsup build output in ESLint), #2050 (background command rejections — #2049), #2025 (pin JSON-editor escaping reproductions), #1976 (github-actions group bumps) |
Activity
cliffhall commentedon Aug 19, 2026
Triage: Priority Medium (total 7)
v2/mainbug; the milestone bonus is the re-scoring case and does not apply to an issue created through the documented flow (which is milestoned by rule).Board: #28, Status
In Progress.Noting the band explicitly because "release" reads as Urgent: severity is genuinely low here, and Urgent is reserved for a severe problem something else confirms is burning.
[-]Merge v2/main into main for the v2.3.0 milestone release[/-][+]Release v2.3.0 step 2: Merge v2/main into main[/+][-]Release v2.3.0 step 2: Merge v2/main into main[/-][+]Release 2.3.0 step 2: Merge v2/main into main[/+][-]Release 2.3.0 step 2: Merge v2/main into main[/-][+]Release 2.3.0 step 2: Merge v2/main into main and cut releease[/+]