---
summary: "Fresh-scaffold devcheck fix (template biome pin 2.5.2), changelog security flag scoped to source-code fixes only, protocol docs synced to as-built, stale startup-linter JSDoc corrected to build-time lint, tag-signing safeguards in the release skills, dependency refresh."
breaking: false
security: false
agent-notes: |
  The security-field comment in changelog/template.md was tightened (source-code
  fixes only — dependency CVE bumps stay under ## Dependencies). If the consumer
  server has a local changelog/template.md, mirror the updated comment from this
  package's copy; the git-wrapup 1.6 skill sync carries the same guidance, but
  the local template file won't update itself.
---

# 0.10.11 — 2026-07-04

## Changed

- **`security` changelog frontmatter** — semantics tightened across both changelog templates, the `build-changelog` JSDoc, and the protocol docs: the flag marks a security fix in this project's own source code only. A dependency or transitive CVE bump is routine maintenance recorded under `## Dependencies` — it must not trip the `🛡️ Security` badge.
- **Protocol docs (`CLAUDE.md`/`AGENTS.md` + template counterparts)** — synced to as-built: definition linting described as build-time (`bun run lint:mcp` / `devcheck`), not startup; init copy list completed (`devcheck.config.json`, example tests, framework `scripts/`, `skills/`, never-overwrite + in-place upgrade); `ContentCollect`/`ContentBlock` and the full `/testing` surface in the exports table; `createApp` `landing` and `context.exposeStatelessSessionId` documented; `canvas` added to `CoreServices`; `Context` gains `sessionId`, `notifyPromptListChanged`, `notifyToolListChanged`, and `ctx.content` (+ section); `test:all` command row and the real `devcheck` check list. Templates additionally: `ctx.state.getMany`, `ctx.enrich`/`ctx.content` rows, `ctx.recoveryFor` error-contract guidance, skills table corrected (`devcheck` removed; `techniques`, `api-mirror` added), commands table moved npm → bun with `lint:mcp`/`lint:packaging`/`list-skills` rows.
- **Skills** — `git-wrapup` 1.6 (tags created with `--cleanup=whitespace`, signed-tag verification in the end-state check, security-flag guidance), `release-and-publish` 2.10 (GH Release pre-flight: the tag signature must parse before `--notes-from-tag`), `orchestrations` 1.5 (same `--cleanup=whitespace` rule), `code-simplifier` 1.2 (`git diff HEAD` + untracked files in Phase 1, gate run after transforming, three transformation-table corrections), `design-mcp-server` 2.19 (Reference tool shape + subsection, unknown-param and omission-semantics probes, recovery-first error design), `api-utils` 2.4, `polish-docs-meta` 2.10.

## Fixed

- **Stale "startup linter" JSDoc** — the errors-contract and `format-parity` notes in `toolDefinition.ts` and the startup-fatal comment in `app.ts` now state the build-time mechanism (`bun run lint:mcp`, gated in `devcheck`); these ship in the published `.d.ts`, where hover docs contradicted actual behavior since the 0.9.0 startup-gate removal ([#263](https://github.com/cyanheads/mcp-ts-core/issues/263)).
- **Fresh-scaffold devcheck failure** — `templates/package.json` pins `@biomejs/biome` 2.5.2 to match the shared config's `$schema`; Biome 2.4.16 refused to load the newer-schema config, so every new scaffold started red ([#260](https://github.com/cyanheads/mcp-ts-core/issues/260)). The `@types/node` pin moves to 26.1.0 alongside.

## Dependencies

- `@biomejs/biome` `2.5.1` → `2.5.2` (`biome.json` `$schema` follows)
- `@cloudflare/vitest-pool-workers` `^0.16.20` → `^0.18.0`
- `@cloudflare/workers-types` `4.20260630.1` → `5.20260705.1`
- `@hono/node-server` `^2.0.6` → `^2.0.8`
- `@opentelemetry/exporter-metrics-otlp-http`, `exporter-trace-otlp-http`, `instrumentation-http`, `sdk-node` `^0.219.0` → `^0.220.0`
- `@opentelemetry/instrumentation-pino` `^0.65.0` → `^0.66.0`
- `@opentelemetry/resources`, `sdk-metrics`, `sdk-trace-node` `^2.8.0` → `^2.9.0`
- `@supabase/supabase-js` `^2.109.0` → `^2.110.0`
- `@types/node` `26.0.1` → `26.1.0`
- `js-yaml` `^5.2.0` → `^5.2.1`
- `tsc-alias` `^1.8.17` → `^1.9.0`
- `vite` `8.1.0` → `8.1.3`
