docs: restore SECURITY.md on v2/main, so the next tree swap can't drop it - #1867
Merged
Conversation
…p it Closes #1864. SECURITY.md was restored to main in #1843 but never added to v2/main. Because v2/main is the develop branch merged into main at milestones, and the two share no common git ancestor, the next milestone merge would silently remove the security policy from the default branch a second time. Copied byte-for-byte from main (sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
This was referenced Jul 31, 2026
There was a problem hiding this comment.
Pull request overview
Restores the repository’s SECURITY.md file on v2/main to ensure the security policy remains present and consistent across branch milestone merges, avoiding regressions from future tree-level operations.
Changes:
- Adds
SECURITY.mdtov2/main(content copied as-is frommain) so the security policy is not inadvertently dropped during future merges.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Aug 1, 2026
Closed
pull Bot
pushed a commit
to Bang2985/inspector
that referenced
this pull request
Aug 5, 2026
Resolves the eight conflicts from the first v2/main -> main milestone merge on a branch cut from main, so v2/main's ancestry stays clean -- resolving them on the PR head would have back-merged main into v2/main, which is exactly what modelcontextprotocol#1868 was closed to avoid. All eight took v2/main's side, each verifiably the newer content: - README.md stale Mcp-Param-* callout; v2/main's is corrected by modelcontextprotocol#1847 (the Inspector builds the headers itself) - SECURITY.md add/add (modelcontextprotocol#1843 on main, modelcontextprotocol#1867 on v2/main); differ by one line, the CONTRIBUTORS.md -> CONTRIBUTING.md rename from modelcontextprotocol#1884 - clients/web/package.json vitest ^4.1.0 -> ^4.1.10, the modelcontextprotocol#1899 fix - the five package-lock.json files, then regenerated from a clean install rather than hand-merged main's release-workflow commits (modelcontextprotocol#1831 least-privilege token, modelcontextprotocol#1834 dist-tag derivation, modelcontextprotocol#1836 OIDC trusted publishing) auto-merged and are preserved -- .github/workflows/main.yml is the only file where the merged tree differs from v2/main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1864.
Recreated from #1865, which GitHub auto-closed when its head branch was renamed
docs/restore-security-md-v2→v2/docs/restore-security-md-v2to satisfy the version-prefix branch convention. Same commit, same content; #1865 could not be reopened because its original head ref no longer exists.Follow-up to #1843, and the same reasoning that moved #1851 onto
v2/main.The gap
SECURITY.mdwas restored tomainin #1843, but it was never added tov2/main.v2/mainis the develop branch, merged intomainat milestone releases. Every milestone merge therefore has to re-resolve this file's absence on the develop side, and any future tree-level operation risks removing the security policy from the default branch a second time. Adding it here makes the two branches agree.The change
Copied byte-for-byte from
main— sha256bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes, verified after the copy. No content changes: #1843 already wrote this file for the post-swap world, so it describes the v2 single-package model and thev1-latestdist-tag correctly as-is.Testing
No source files are touched, so no
validate/coveragegate measures this change.npx prettier --check SECURITY.mdpasses.Note
.github/workflows/claude.yml(#1851) and this file are the two known instances. Anything else restored directly tomainafter the swap is suspect for the same reason — a sweep is probably worth doing separately.🤖 Generated with Claude Code
https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU