chore(release): staging to production - 2026.03.04

[github-actions]

🚀 Release: Staging to Production

Release Date: 2026-03-04

Changes in this release

• fix: bump @modelcontextprotocol/sdk to 1.18.0 (74bbdde)

---

This PR is automatically created/updated when commits are pushed to staging.
Merging this PR will trigger the release workflow to create a new GitHub release.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
answerai-docs	Building	Preview	Mar 4, 2026 1:49pm
the-answerai	Building	Preview	Mar 4, 2026 1:49pm

[claude]

PR Review: chore(release): staging to production - 2026.03.04

PR: #992 — Staging to Production Release
Author: github-actions (automated release PR)
Base: production
Change scope: 2 files changed (+95/-74) — packages/components/package.json and pnpm-lock.yaml

---

Summary

This is an automated release PR that bumps @modelcontextprotocol/sdk from ^1.10.1 to ^1.18.0 (the lockfile resolves to 1.26.0). The change is a targeted dependency upgrade to resolve production-only MCP server initialization timeouts (error code -32001, 60s timeout) affecting Atlassian integrations (Confluence + Jira). The root cause was that SDK 1.10.1 introduced a timeout regression that only manifested on the production network path to Atlassian APIs, not in staging.

---

Critical Issues

None identified. This is a pure dependency update with no application logic changes.

---

Major Concerns

1. Declared version vs. resolved version mismatch

Location: packages/components/package.json line ~75 and pnpm-lock.yaml snapshots section

Issue: package.json declares "@modelcontextprotocol/sdk": "^1.18.0" but the lockfile resolves to 1.26.0. This is a significant jump — 8 minor versions beyond what is declared. The ^ semver range allows pnpm to resolve the latest compatible version, which in this case is 1.26.0. Any breaking changes introduced between 1.18.0 and 1.26.0 would not be caught by the declared constraint.

Why it matters: The PR description and commit message specifically reference bumping to 1.18.0, but the system is actually running 1.26.0. If a regression exists in any version between 1.18.x and 1.26.x, it would be invisible from the version declaration alone. This also makes the commit message and PR title misleading for future debugging.

Suggestion: Consider pinning the version exactly ("@modelcontextprotocol/sdk": "1.26.0") to match what is actually installed, or update the PR description to clarify the resolved version. At minimum, future references should note the actual resolved version.

2. New transitive dependencies introduced without explicit audit

Location: pnpm-lock.yaml — snapshots for @modelcontextprotocol/sdk@1.26.0

Issue: SDK 1.26.0 introduces several new transitive dependencies that were not present in 1.18.0:

• hono@4.11.9 — a new HTTP framework
• @hono/node-server@1.19.9 — Hono Node.js adapter
• jose@6.1.3 — JWT/JOSE library
• json-schema-typed@8.0.2 — JSON schema types
• ajv@8.17.1 + ajv-formats@3.0.1 — upgraded from ajv@6.12.6
• cors@2.8.6 — minor patch bump from 2.8.5

The addition of hono and jose in particular suggests the SDK now ships OAuth/auth primitives internally. These are non-trivial additions to the dependency surface. It is worth verifying whether these new capabilities conflict with existing Express middleware or auth patterns in the codebase.

Suggestion: Confirm no peer dependency conflicts were introduced and that the new jose dependency does not shadow or conflict with any JWT libraries already in use in packages/server.

---

Suggestions

1. Update the PR description to reflect the actual resolved SDK version

The PR body and commit message reference bumping to 1.18.0, but the lockfile installs 1.26.0. Accurate records matter for incident retrospectives. Consider noting: "package.json declares ^1.18.0, pnpm resolves to 1.26.0."

2. Consider adding a regression test for MCP server initialization

Since this fixes a production timeout that did not manifest in staging, there is currently no automated guard against this class of regression returning. Even a smoke test that verifies an MCP client can initialize without timing out against a mock server would provide a safety net for future SDK bumps.

3. Minor cleanup — removed packages confirm correct deduplication

The removal of express-rate-limit@7.5.1, pkce-challenge@5.0.0, and the old @modelcontextprotocol/sdk@1.18.0 lockfile entry is clean. The upgrade to express-rate-limit@8.2.1 and pkce-challenge@5.0.1 along with the SDK bump is correctly reflected across all consumers (@answerai/confluence-mcp, @answerai/jira-mcp, supergateway, youtube-data-mcp-server).

---

Positive Observations

• The commit message is well-written: it clearly describes the root cause (network latency differences between staging and production exposing a timeout regression in 1.10.1), the error manifestation (HTTP/2 errors + EventSource failures), and the remediation approach. This is exactly the kind of context that makes future debugging tractable.
• The automated release PR workflow is functioning correctly — the PR is properly labeled release and targets the production branch.
• The lockfile changes are internally consistent. All dependent packages (@answerai/confluence-mcp, @answerai/jira-mcp, supergateway, youtube-data-mcp-server) have been correctly updated to use the new SDK version with proper peer dependency annotations (@cfworker/json-schema@4.1.1, zod@3.22.4).
• zod-to-json-schema was also updated from 3.24.6 to 3.25.1 across all consumers — a clean incidental improvement that reduces version duplication.
• No application code, routes, controllers, or services were modified. Multi-tenancy (organizationId) and authentication (enforceAbility) patterns are unaffected by this change.

---

Checklist Assessment

Check	Status
Multi-tenancy (organizationId filters)	N/A — no DB query changes
Authentication (enforceAbility middleware)	N/A — no route changes
Error handling (InternalFlowiseError)	N/A — no logic changes
Test coverage	No new tests; see suggestion #2 above
Database migrations	N/A
Security — no hardcoded secrets	Pass
Security — no new vulnerable packages (surface check)	Pass — all new deps are well-known libraries

---

Recommendation

Approve with minor notes. The change is narrowly scoped, the root cause analysis in the commit message is solid, and the lockfile changes are consistent. The two items worth noting are (1) clarifying the declared vs. resolved version discrepancy in the PR description and (2) optionally adding a targeted regression test for MCP initialization timeouts. Neither blocks the merge for a production hotfix.

---

Review conducted by Claude Code (claude-sonnet-4-6)