Repository navigation
Release 2.5.0 step 2: merge v2/main into main and cut the release #2214
Description
Milestone v2.5.0
The fifth v2/main → main milestone merge, cutting 2.5.0. This is step 2 of the release procedure; step 1 (the version bump on v2/main) is #2212 / #2213 and has already landed.
main currently holds 2.4.0 (merged via #2143 / #2145) and has not moved since — no Dependabot PR landed on it directly this cycle. v2/main has accumulated 33 merged PRs (213 non-merge commits) on top of it, closing 37 issues on the v2.5.0 milestone.
Scope
- Branch from
main, mergeorigin/v2/main. - Open a PR against
mainand run the gate green on the merged tree. - After merge: tag
origin/mainas bare2.5.0and draft the GitHub Release — publishing runspack:verify, asserts the tag matchespackage.json, and publishes thelatestdist-tag.
The version bump is not part of this issue — it landed on v2/main first (#2213), per the #2010 procedure, and arrives here as part of the payload.
Conflicts
None. A trial merge of main with origin/v2/main went through with zero conflicted paths, and the merged tree is byte-identical to origin/v2/main (git diff origin/v2/main HEAD is empty). main's tip is still an ancestor of this branch's first parent — nothing has landed on main since #2145 — so every path three-way merged clean.
Re-check the trial merge before opening the PR anyway: a Dependabot PR merged to main in the interim would reintroduce the lockfile conflict the v2.3.0 merge hit, and any security bumps must survive it.
Payload
| Group | PRs |
|---|---|
| Release mechanics | #2213 (bump to 2.5.0 — #2212) |
| App.tsx decomposition (#2126) | #2149 (phase 0: module-level block into files — #2127), #2150 (phase 1: leaf hooks — #2128), #2152 (useSessionRef — #2157), #2162 (useOAuthRecovery — #2153), #2166 (useMcpApps — #2156), #2169 (useConnectionLifecycle — #2154), #2173 (useServerCommands — #2155), #2182 (phase 3: InspectorView's prop wall into domain bundles — #2130), #2191 (resolve the react-hooks findings the decomposition unmasked — #2161) |
| React state correctness | #2193 (read state stores during render instead of re-syncing in an effect — #1955), #2194 (lint core/react/ with eslint-plugin-react-hooks — #2192), #2190 (terminate the five void-discarded OAuth recovery promises — #2165), #2179 (surface failed resource subscribe/unsubscribe — #2174) |
| Authorization | #2186 (revoke OAuth tokens at the authorization server on clear, RFC 7009 — #2144), #2184 (accept RFC 8414 metadata served at the OIDC well-known path — #2172) |
| Tools & JSON editing | #2170 (Ace JSON editor everywhere, and the raw-JSON toggle restored — #2151), #2175 (refuse a raw-JSON tool argument the schema would retype — #2171), #2137 (render tool schemas with a root-level anyOf/oneOf — #2123) |
| Protocol & transport | #2185 (cancel a Streamable HTTP call by closing its stream — #2140), #2176 (say why a never-acknowledged subscriptions/listen ended instead of retrying it eight times — #2097) |
| Dependency consolidation (#2030) | #2200 (runtime dependencies into the root manifest — #2195), #2199 (shared toolchain devDependencies into the root manifest — #2196) |
| Smokes, gate & CI (#2031) | #2133 (headless web smokes in Firefox — #2086), #2164 (connected-flow smokes for Tools/Resources/Prompts — #2148), #2158 (smoke:tui asserts survival, not first paint — #2147), #2167 (rename the local pre-push gate off ci — #2146), #2160 (coverage gate in a parallel CI job — #2159), #2178 + #2181 (render-smoke startup budget and clock anchoring — #2177, #2180) |
| Docs & agent skills | #2189 (extract AGENTS.md recipes into agent skills — #2163), #2203 (tune skill eval cases and document how to write them — #2202) |
Three milestone issues closed without a PR of their own: #2126, #2030 and #2031 are parent trackers whose sub-issues carried the work; #2132 (WebKit SSE tail) closed with its cross-chunk parseSSE half shipped in v2.4.0 via #2135, the WebKit matrix entry deliberately left out.
After merge
- Close this issue manually and move its card to Done — a merge PR into
mainusesReferencesby convention, so no closing keyword fires. - Close out the v2.5.0 milestone, moving anything still open on it to v2.6.0.
Activity
chore: merge v2/main for the v2.5.0 milestone release