Skip to content

Document the two-line release process for stable v2 #3179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
maxisbey wants to merge 1 commit into
base: main
Choose a base branch
from
+105 −50
Open

Document the two-line release process for stable v2 #3179

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
155 changes: 105 additions & 50 deletions RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,63 +7,118 @@
`[tool.hatch.metadata.hooks.uv-dynamic-versioning].dependencies`.
2. Upgrade lock with `uv lock --resolution lowest-direct`

## Major or Minor Release

Stable releases are cut from the `v1.x` branch. Create a GitHub release via UI
with the tag being `vX.Y.Z` where `X.Y.Z` is the version and the release title
being the same, and **set the tag's target to the `v1.x` branch** — the UI
defaults to `main`, which is the v2 rework, and a v1 tag created there would
publish the v2 codebase as a stable release. Then ask someone to review the
release.

The package version will be set automatically from the tag.

## v2 Pre-releases

v2 pre-releases are cut from `main` with a PEP 440 pre-release tag: `v2.0.0aN`
for alphas, later `bN`/`rcN` for betas and release candidates.

A release publishes two distributions, `mcp` and `mcp-types`, at the same
version, and the `mcp` wheel exact-pins `mcp-types`. Before the first release
that includes both, the `mcp-types` PyPI project must be given the same
trusted publisher as `mcp` (this repository, workflow `publish-pypi.yml`,
environment `release`) and the same owners — without it the `mcp-types`
upload is rejected. If only some of the files upload, fix the cause and re-run
the publish job — `skip-existing` makes it skip whatever already landed. The
`Development Status` classifier in both `pyproject.toml` files is permanently
`5 - Production/Stable`; it is not bumped as part of any release.

1. Update the pre-release version examples in `README.md` and the docs
(grep the outgoing version — the pins live in the README Installation
section, `docs/index.md`, `docs/get-started/installation.md`, and `docs/get-started/real-host.md`) so the tagged
commit — and therefore the README PyPI publishes — names the version
being released. When entering a new phase (alpha → beta → rc), update
the banner wording too.
2. Check the full test matrix is green on the release commit. The publish
workflow re-runs the checks and blocks publishing until they pass, so a
red leg there means re-running the failed jobs on the Publishing run.
3. Create the release as a pre-release, passing the exact commit verified in
step 2 as `--target` (otherwise the tag is created from whatever `main`'s
HEAD is by then). The tagged commit determines everything about the
## Release lines

Two branches ship, and the package version comes from the git tag
(`uv-dynamic-versioning`). Publishing a GitHub release runs `publish-pypi.yml`
**from the tagged commit**, so the workflow that fires is the tagged branch's

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: A v1.x release will use the default-branch release workflow, not a workflow definition from v1.x; current publish-pypi.yml therefore attempts to build mcp-types too. Document/configure a default-branch workflow that branches on the release tag (or use a supported separate trigger) before directing maintainers to cut v1 releases this way.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At RELEASE.md, line 14:

<comment>A `v1.x` release will use the default-branch release workflow, not a workflow definition from `v1.x`; current `publish-pypi.yml` therefore attempts to build `mcp-types` too. Document/configure a default-branch workflow that branches on the release tag (or use a supported separate trigger) before directing maintainers to cut v1 releases this way.</comment>

<file context>
@@ -7,63 +7,118 @@
+
+Two branches ship, and the package version comes from the git tag
+(`uv-dynamic-versioning`). Publishing a GitHub release runs `publish-pypi.yml`
+**from the tagged commit**, so the workflow that fires is the tagged branch's
+own: a `main` tag builds and publishes two distributions (`mcp` and
+`mcp-types`, lock-stepped via `Requires-Dist: mcp-types=={{ version }}`), and a
</file context>

own: a `main` tag builds and publishes two distributions (`mcp` and
`mcp-types`, lock-stepped via `Requires-Dist: mcp-types=={{ version }}`), and a
`v1.x` tag builds and publishes `mcp` only.

| Line | Branch | Tag | GitHub release flags |
| ---------------------------- | ------ | ------------------------- | ------------------------------------- |
| Current stable | `main` | `v2.X.Y` | not a pre-release; becomes **Latest** |
| Maintenance (previous major) | `v1.x` | `v1.28.Z` | not a pre-release; **not** Latest |
| Pre-releases | `main` | `v2.X.YaN` / `bN` / `rcN` | **Pre-release** ticked, never Latest |

The `Development Status` classifier in both `pyproject.toml` files is
permanently `5 - Production/Stable`; it is not bumped as part of any release.
The `mcp-types` PyPI project carries the same trusted publisher as `mcp` (this
repository, workflow `publish-pypi.yml`, environment `release`). If only some
of the four files upload, fix the cause and re-run the publish job —
`skip-existing` makes it skip whatever already landed.

## Stable release from `main` (`v2.X.Y`)

The stable line's README and docs carry no version pin (`pip install "mcp[cli]"`
installs the newest stable release), so a stable release needs no pin-flip
commit. `README.md` at the tagged commit is the PyPI long description, so any
README fix has to merge before the tag.

Check failure on line 37 in RELEASE.md

View check run for this annotation

Claude / Claude Code Review

First stable cut (v2.0.0) does need a pin-flip commit 

The stable-release section opens with "The stable line's README and docs carry no version pin ... so a stable release needs no pin-flip commit", but at the moment this section is first used — cutting v2.0.0 — the README and docs still pin `mcp[cli]==2.0.0b1` and carry the pre-release banner, so following it verbatim publishes an immutable PyPI long description for v2.0.0 that instructs users to install a beta. Add a note that the first stable release requires the pin-drop/banner-removal commit b
Comment on lines +34 to +37

@claude claude Bot Jul 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 The stable-release section opens with "The stable line's README and docs carry no version pin ... so a stable release needs no pin-flip commit", but at the moment this section is first used — cutting v2.0.0 — the README and docs still pin mcp[cli]==2.0.0b1 and carry the pre-release banner, so following it verbatim publishes an immutable PyPI long description for v2.0.0 that instructs users to install a beta. Add a note that the first stable release requires the pin-drop/banner-removal commit before tagging (or cross-reference the phase-transition instruction in step 1 of the Pre-releases section).

Extended reasoning...

The bug. The new "Stable release from main (v2.X.Y)" section is premised on a steady state that does not yet exist. Its opening sentence — "The stable line's README and docs carry no version pin (pip install \"mcp[cli]\" installs the newest stable release), so a stable release needs no pin-flip commit" — is false at the one moment the section will first be executed: the v2.0.0 cut, which the PR description names as this doc's primary audience ("The person cutting v2.0.0 ... reads this file").

Current state of the tree. README.md:44-47 pins mcp[cli]==2.0.0b1 and carries the banner "The pin matters while v2 is in pre-release"; the same ==2.0.0b1 pin appears in docs/index.md, docs/get-started/installation.md, and docs/get-started/real-host.md ("The pin is mandatory while v2 is in beta"). So contrary to the section's premise, a pin-drop/banner-removal commit is required before tagging v2.0.0.

Why the doc doesn't otherwise prevent the mistake. The only instruction to drop the pins lives in step 1 of the separate "Pre-releases from main" section ("When entering a new phase (alpha → beta → rc → stable), update the banner wording too; the stable phase drops the pins"). A release engineer performing a stable release has no procedural reason to read the pre-release section — and the stable section affirmatively tells them the opposite ("needs no pin-flip commit"), actively steering them away from the required step.

Impact. The doc itself explains why this matters: "README.md at the tagged commit is the PyPI long description." Following the stable section verbatim tags v2.0.0 on a commit whose README tells users to pip install \"mcp[cli]==2.0.0b1\" and describes v2 as pre-release. Under the doc's own rules the published long description for that version is immutable — never delete a release from PyPI, versions cannot be reused — so the only remedy is cutting v2.0.1. That is a concrete, effectively irreversible publication mistake for the flagship stable release, caused by the very document written to prevent it.

Step-by-step proof. (1) The release engineer preparing v2.0.0 opens RELEASE.md and jumps to "Stable release from main (v2.X.Y)" — the section named for their task. (2) They read "a stable release needs no pin-flip commit" and therefore make no README/docs change. (3) They follow steps 1–3: verify green, freeze main, run gh release create v2.0.0 --title v2.0.0 --target <sha> .... (4) publish-pypi.yml runs from the tagged commit and publishes mcp 2.0.0 with the tagged README.md as its long description. (5) The PyPI page for stable v2.0.0 — now what pip install mcp resolves to — instructs pip install \"mcp[cli]==2.0.0b1\" and says "Do not use v2 in production" / "The pin matters while v2 is in pre-release". (6) Per the yank rules in step 5 of the same section, the fix requires releasing v2.0.1.

Fix. One sentence in the stable section: note that the first stable release (v2.0.0) requires the pin-drop/banner-removal commit to land before the tag (the phase-transition step described in the Pre-releases section, step 1) — or rephrase the opening so the "no pin-flip" claim is explicitly conditional on the pins having already been dropped at the pre-release → stable transition.

Severity. All three verifiers confirmed the finding; two rated it normal, one nit (on the grounds that the information exists elsewhere in the same file and the window is a single release). Normal is warranted here: the single release in the window is exactly the release this PR was written to instruct, the section doesn't merely omit the step but asserts its negation, and the failure it invites is an immutable published artifact fixable only by cutting another version — while the fix is one sentence.


1. Check the full test matrix is green on the release commit. The publish
workflow re-runs the same checks and blocks publishing until they pass, so a
red leg there means re-running the failed jobs on the Publishing run — but
verify green before creating the release rather than discovering red after
the tag exists.
2. Freeze `main` from that commit until the tag exists: the release is created
with an explicit `--target`, and nothing else should land in between.
3. Create the release NOT as a pre-release, passing the verified commit as
`--target` (otherwise the tag is created from whatever `main`'s HEAD is by
then). It becomes GitHub "Latest", and PyPI's default `pip install mcp`
version moves to it. The tagged commit determines everything about the
release — the workflows that run and the package metadata (readme,
classifiers) that gets published — so it must contain the current release
tooling, not just pass tests. `--target` is ignored if the tag already
exists: when re-creating a release, delete the old tag first and
double-check where the new tag points. The pre-release flag keeps GitHub's
"Latest" badge and `/releases/latest` pointing at the stable v1.x line:
double-check where the new tag points.

```shell
gh release create v2.X.Y --title v2.X.Y --target <commit-sha> --notes-file <notes.md>
```

4. Curate the release notes above the auto-generated `## What's Changed` list:
the highlights, anything known-incomplete, and links to the docs and
migration guide. Use absolute URLs (relative links don't resolve in GitHub
release bodies), and set the generated list's **Previous tag** to the
previous release on this line by hand — the auto-picked baseline is the
newest tag, which may sit on the other line.
5. If a stable release turns out to be broken, yank it on PyPI and release the
fix as the next patch version. Never delete a release from PyPI — version
numbers cannot be reused. Yank `mcp` and `mcp-types` together (they are one
release), and set the yank reason and the GitHub release notes to point at
the replacement version, since yanking doesn't stop `==` pins from installing
the broken version.

## Maintenance release from `v1.x` (`v1.28.Z`)

Land the `[v1.x]`-prefixed backport PRs (and any README banner update, which is
the README PyPI shows for that version), verify the branch tip green, then
create the release the same way with two differences:

- **The tag's target is the `v1.x` branch.** The UI and CLI default the target
to `main`, which is the v2 codebase — a v1 tag created there would publish v2
code as a v1 stable release.
- **It must not take "Latest" back from the 2.x line.** The UI ticks "Set as
the latest release" by default for the newest non-pre-release; untick it, or
pass `--latest=false`, and afterwards confirm `/releases/latest` still names
the newest v2 tag. If it slipped, `gh release edit v1.28.Z --latest=false`
fixes it — release metadata only, no re-cut.

```shell
gh release create v1.28.Z --title v1.28.Z --target v1.x --latest=false --notes-file <notes.md>
```

When generating notes, set **Previous tag** to the previous `v1.*` release by
hand for the same reason as above. Then ask someone to review the release.

## Pre-releases from `main`

Pre-releases of the next version are cut from `main` with a PEP 440
pre-release tag: `aN` for alphas, later `bN`/`rcN` for betas and release
candidates. The PEP 440 suffix is what keeps `pip install mcp` on the stable
version — installers only select a pre-release when it is requested by exact
pin.

1. During a pre-release phase the README and docs pin the exact pre-release
version, so update those examples first (grep the outgoing version — the

Check warning on line 104 in RELEASE.md

View check run for this annotation

Claude / Claude Code Review

Pre-release selection is not limited to exact pins 

The claim that installers only select a pre-release "when it is requested by exact pin" is over-narrow: pip also resolves pre-releases with `--pre`, and with any specifier that names a pre-release version (e.g. `pip install 'mcp>=2.1.0b1'`); uv behaves similarly via `--prerelease allow`. Consider rewording to "installers skip pre-releases unless explicitly requested — via `--pre` or a specifier naming a pre-release version."
Comment on lines +100 to +104

@claude claude Bot Jul 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The claim that installers only select a pre-release "when it is requested by exact pin" is over-narrow: pip also resolves pre-releases with --pre, and with any specifier that names a pre-release version (e.g. pip install 'mcp>=2.1.0b1'); uv behaves similarly via --prerelease allow. Consider rewording to "installers skip pre-releases unless explicitly requested — via --pre or a specifier naming a pre-release version."

Extended reasoning...

The issue. The new "Pre-releases from main" section (RELEASE.md:100-104) states: "The PEP 440 suffix is what keeps pip install mcp on the stable version — installers only select a pre-release when it is requested by exact pin." The word "only" makes this a false universal. Per pip's documented pre-release handling, a pre-release is selected in three cases, not one:

  1. An exact pin naming a pre-release (mcp==2.1.0b1) — the case the doc mentions.
  2. The --pre flag: pip install --pre mcp will install the newest version including pre-releases.
  3. Any version specifier that itself names a pre-release version, with any operator — e.g. pip install 'mcp>=2.1.0b1'. Per PEP 440 / the packaging library's specifier semantics, a specifier containing a pre-release segment implicitly enables pre-release candidates for that resolution.

uv behaves analogously: --prerelease allow (or UV_PRERELEASE=allow), and its default if-necessary-or-explicit mode admits pre-releases when a requirement explicitly names one.

Concrete walk-through. Suppose 2.0.0 (stable) and 2.1.0b1 (pre-release) are both on PyPI. pip install mcp → installs 2.0.0 (correct, and this is the clause the doc gets right). But pip install --pre mcp → installs 2.1.0b1 with no pin at all, and pip install 'mcp>=2.1.0b1' → also installs 2.1.0b1, again with no exact pin. So "only … exact pin" is contradicted by two documented, commonly-used mechanisms.

Why it matters (and why it's minor). This file exists to give the release manager a precise mental model of release mechanics — that's the stated purpose of the rewrite in this PR — so a factually wrong universal in freshly-added prose is worth fixing. That said, nothing in the actual release procedure depends on the erroneous clause: the operative claim (the PEP 440 suffix keeps plain pip install mcp on stable, so pre-releases never hijack the default install) is true, and every pin example in the doc uses ==. No release step goes wrong if this merges as-is.

Fix. One-line rewording, e.g.: "The PEP 440 suffix is what keeps pip install mcp on the stable version — installers skip pre-releases unless explicitly requested, via --pre (--prerelease allow for uv) or a specifier naming a pre-release version."

All three verifiers independently confirmed the factual claim against pip's documented behavior and agreed on nit severity; there were no refutations. Docs-only, non-blocking.

pins live in the README Installation section, `docs/index.md`,
`docs/get-started/installation.md`, and `docs/get-started/real-host.md`) so
the tagged commit — and therefore the README PyPI publishes — names the
version being released. When entering a new phase (alpha → beta → rc →
stable), update the banner wording too; the stable phase drops the pins.
2. Check the full test matrix is green on the release commit, as above.
3. Create the release as a pre-release, passing the verified commit as
`--target`. The pre-release flag keeps GitHub's "Latest" badge and
`/releases/latest` on the newest stable release:

```shell
gh release create v2.0.0aN --prerelease --title v2.0.0aN --target <commit-sha>
gh release create v2.X.YbN --prerelease --title v2.X.YbN --target <commit-sha>
```

4. Curate the release notes instead of relying on auto-generated ones: what
changed since the previous pre-release, what is known-incomplete, the
install line (`pip install mcp==2.0.0aN`), and a link to the migration
guide. Use the absolute URL
(`https://github.com/modelcontextprotocol/python-sdk/blob/main/docs/migration.md`)
because relative links don't resolve in GitHub release bodies.
4. Curate the release notes: what changed since the previous pre-release, what
is known-incomplete, the install line (`pip install mcp==2.X.YbN`), and a
link to the migration guide, with absolute URLs.
5. If a pre-release turns out to be broken, yank it on PyPI and cut the next
one. Never delete a release from PyPI — version numbers cannot be reused.
Yanking doesn't stop `==` pins from installing the broken version, so set
the yank reason (and edit the GitHub release notes) to point at the
one, pointing the yank reason and the GitHub release notes at the
replacement version.
Loading