v2.4.02026-11-11
Security fixes
v2.4.0 fixes six vulnerabilities in three servers. Upgrade @modelcontextprotocol/server-filesystem to 2.3.0,
and mcp-server-git and mcp-server-fetch to 2026.11.11.
| Package | Affected | Fixed in |
| --- | --- | --- |
| @modelcontextprotocol/server-filesystem | all versions before 2.3.0, and date versions 2025.1.14 through 2026.8.31 | 2.3.0 |
| mcp-server-git | through 2026.11.4 | 2026.11.11 |
| mcp-server-fetch | through 2026.11.4 | 2026.11.11 |
@modelcontextprotocol/server-filesystem 2.3.0
Reads stay with the file that was checked (Linux and macOS). The read tools and file resources now open a file relative to the directory that was checked, as writes already did, so a directory swapped for a symlink between the access check and the read can no longer return a file from outside the allowed directories. A FIFO, socket or device is refused rather than read. On Windows this narrows the race without closing it**, as for writes (#5260) (GHSA-p9cv-8g75-4xcg)
movefile moves only the source it checked. A move within one device first takes the source out of its own checked directory under a fresh name, so a source directory swapped for a symlink can no longer bring an outside file into the allowed directories, where it would become readable (GHSA-7m4x-rv66-mxhh)
mcp-server-git 2026.11.11
A repository's own Git configuration can no longer make the server run a program. A read-only call such as gitstatus on an untrusted repository used to run a command named in its .git/config (core.fsmonitor, diff.external, hooks, filter and merge drivers, signing) with the server's privileges. Every Git command now overrides those settings, and a Git older than 2.31, which would ignore the overrides, is refused (GHSA-6hqx-gqrx-c5r2)
--repository confinement covers alternate object stores, linked worktrees and links in the Git directory. A repository inside the allowed one could read another repository's objects through objects/info/alternates, or pass a linked worktree's Git directory off as the allowed repository's. Both are refused, as is a symlink in a Git directory that leads outside the allowed repository. On Windows a directory junction is not yet covered** (#5520) (GHSA-q74p-4wrc-q7w6)
mcp-server-fetch 2026.11.11
IPv6 site-local addresses are private.** The private-address guard read fec0::/10 as public. It is now refused, and so is any IPv6 address outside global unicast (2000::/3) that does not carry an IPv4 address (GHSA-3rxj-6jhw-qfv7)
robots.txt is matched against the path the site will resolve**, as well as the path as written, so //private or /x/../private can no longer get past Disallow: /private (GHSA-f9hh-cmx9-2f23)
Upgrading from a date-versioned npm release
The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.3.0 below every 2025.x and 2026.x version, so they won't offer it as an upgrade. If you are on a date version of @modelcontextprotocol/server-filesystem, install 2.3.0 explicitly: npm install @modelcontextprotocol/server-filesystem@2.3.0.
Packages
| Package | Version | Registry | In this release |
| --- | --- | --- | --- |
| @modelcontextprotocol/server-everything | 2.3.0 | npm | published |
| @modelcontextprotocol/server-filesystem | 2.3.0 | npm | published |
| @modelcontextprotocol/server-memory | 2.1.1 | npm | published |
| @modelcontextprotocol/server-sequential-thinking | 2.1.1 | npm | unchanged |
| mcp-server-fetch | 2026.11.11 | PyPI | published |
| mcp-server-git | 2026.11.11 | PyPI | published |
| mcp-server-time | 2026.11.11 | PyPI | published |
Release ledger: v2/chore/5509-release-v2.4.0
@modelcontextprotocol/server-everything 2.3.0
What's Changed
* fix(everything): count tasks/update answers in UTF-8 bytes by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5449
* everything: bind the HTTP transports to loopback by default, with HOST to widen by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5452
* feat: describe every tool input property (#3669) by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5475
* chore(deps): monthly dependency refresh (November 2026) by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5476
* fix(docker): run every server image as its non-root user by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5473
* chore(everything): drop the unused jszip dependency by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5478
* chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5470
* Release v2.4.0: merge v2/main into main by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5518
@modelcontextprotocol/server-filesystem 2.3.0
What's Changed
* chore(docker): build filesystem, memory and sequentialthinking from the workspace lockfile by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5469
* feat: describe every tool input property (#3669) by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5475
* feat(filesystem, memory): say when to use each list and delete tool by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5460
* fix(docker): run every server image as its non-root user by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5473
fix(filesystem): read searchfiles excludePatterns like directory_tree by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5446
fix(filesystem): an excludePatterns glob ending in "/" prunes the directory it names by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5456
fix(filesystem): match editfile oldText that ends with a newline by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5447
* fix(filesystem): report a missing parent directory, not a raw chdir error by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5448
* feat(filesystem): refuse NTFS alternate-data-stream paths on Windows by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5450
* feat(filesystem): refuse Windows device names and trailing dots/spaces in paths by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5458
* filesystem: per-directory read-only access with --read-only-dir by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5451
* fix(filesystem): GHSA-p9cv-8g75-4xcg by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5516
* chore: version packages by @github-actions[bot] in https://github.com/modelcontextprotocol/servers/pull/5470
* Release v2.4.0: merge v2/main into main by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5518
@modelcontextprotocol/server-memory 2.1.1
What's Changed
* chore(docker): build filesystem, memory and sequentialthinking from the workspace lockfile by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5469
* feat: describe every tool input property (#3669) by @cliffhall in https://github.com/modelcontextprotocol/servers/pull/5475
* feat(filesystem, m
v2.3.02026-11-04
MCP 服务器 v2.3.0 版本发布，七个包同步上架 npm 与 PyPI。本版重点在 filesystem（2.2.0）：新增 appendfile 与 copyfile 两个工具，directorytree 支持可选的 depth 参数；只读工具补上了 idempotentHint 与 destructiveHint 注解。一批边角问题也顺手修掉——readtextfile 传 head/tail 为 0 时不再误返内容，失效符号链接归类为 broken 而非父目录缺失，Windows 下 ~\ 能正确展开到主目录，realpath 之后的允许目录名不再被裁剪，searchfiles 的文档改为明确说明只匹配文件名。
server-everything（2.2.1）的 Docker 镜像改由 workspace lockfile 构建并加入 Streamable HTTP 模式，取消长时运行操作现在能真正中断，所有原语补上了浅色与深色图标，另增资源集合示例。server-memory（2.1.0）、server-sequential-thinking（2.1.1）及 PyPI 三件套（2026.11.4）同步发布。
v2.2.02026-10-28
这是一次以安全为主的例行发布。eMudhra 八张中间 CA 证书的私钥被曝可从公开证书中恢复，Node.js 随后推送安全版本更新内置 CA 列表，Python 的 certifi 2026.10.23 也移除了相关根证书。各服务器受影响程度不同：TypeScript 系列自带证书检查依赖所在 Node.js 运行时，请自行升级到 Node.js 24.22.1 或 26.12.1 及以上（engines 只要求 Node.js 24，npm 不会提示你版本过旧）；mcp-server-fetch 走 certifi，已有环境用 uvx --refresh mcp-server-fetch 或 pip install -U certifi 刷新；mcp-server-git、mcp-server-time 不联网，无影响。
本版发布：server-everything 2.1.0、server-filesystem 2.1.0、server-memory 2.0.1，以及三个 PyPI 包 2026.10.28；server-sequential-thinking 2.0.0 未变。server-everything 修了若干实际问题：elicitation 表单摘要、gzip-file-as-resource 遇 HTTP 错误时不再静默成功并逐跳拦截非公网地址、get-env 默认掩码凭据类字段、get-tiny-image 剔除损坏的 PNG iCCP 块；server-filesystem 则放行目录名仅大小写不同的写法。
v2.1.02026-10-25
v2.1.0 是一次安全更新，修掉三个 MCP 服务器共八个漏洞，建议尽快升级。
filesystem 2.0.1 堵住几处路径穿越：访问检查与写入之间父目录被换成符号链接，writefile、editfile 等也不会写到允许目录之外（Windows 仅部分修复，详见公告）；检查不再忽略路径尾部的引号与空白；大小写不一致的符号链接不再通过校验；listdirectorywith_sizes 先逐项校验再读大小，不再借符号链接泄露
v2.0.02026-10-19
MCP 官方服务器全线升级到 2.0.0（Python 系列为 2026.10.19），统一重构以支持现代协议规范，同时仍能正常响应旧版客户端的请求，升级无需担心兼容断裂。
TypeScript 服务器全部迁移至 TS SDK v2，并跟进 modern-era 规范带来的新功能；Node.js 最低版本要求从旧值提高到 24，CI 现在在 Node 22、24、26 上并行验证。
server-filesystem 这版修了三处 roots 相关的竞态：更新后若无有效根目录会立即撤销访问权限、只采纳最新一次刷新的结果、刷新挂起期间会暂停工具调用，避免读到过期的目录权限。
涉及 npm 包 @modelcontextprotocol/server-everything、server-filesystem、server-memory、server-sequential-thinking 的 2.0.0，以及 PyPI 上 mcp-server-fetch、mcp-server-git、mcp-server-time 的 2026.10.19。
v1.0.02026-10-11
MCP 官方服务端迎来 legacy 时代的收官版本：npm 上的 @modelcontextprotocol/server-everything、server-filesystem、server-memory、server-sequential-thinking 全部升至 1.0.0，PyPI 上的 mcp-server-fetch、mcp-server-git、mcp-server-time 则发布 2026.10.10，这批版本集中修复了大量缺陷与安全隐患，之后不再有后续更新。
改动最大的是 server-everything：会话断开时会正确清理订阅，SSE 端口被占用时改为如实报错；未知或重复的 HTTP+SSE 会话有了明确响应，Streamable HTTP 对未知会话返回 404，服务关闭时会话随之关闭；会话资源被隔离到各自服务端，动态 blob 资源标注为 application/octet-stream，异步任务工具也被限制在发起它的客户端任务内。server-filesystem 补上了 zod 运行时依赖声明，并修复了 macOS 下 unicode 路径的测试问题。此外，TypeScript 服务端引入了 changesets 发布流程和每文件 90% 的测试覆盖率门槛。
Release 2026.8.312026-08-31
v2026.8.31 仅例行升级了四个 MCP 官方包（filesystem、memory、sequential-thinking、everything），同步到同版本号，无功能性变更。
Release 2026.8.182026-08-18
v2026.8.18 是一次例行版本同步，仅将 @modelcontextprotocol/server-everything、mcp-server-time、mcp-server-fetch、mcp-server-git 四个 MCP 服务包统一升级至 2026.8.18，无功能与修复层面的实质变更。
Release 2026.7.102026-07-10
v2026.7.10 是一次例行的依赖包同步更新，@modelcontextprotocol/server-filesystem、mcp-server-time、mcp-server-fetch、mcp-server-git 四个 MCP 服务包版本统一升至 2026.7.10，与主版本保持一致；本次没有功能改动或问题修复。
Release 2026.7.42026-07-04
v2026.7.4 版本发布，同步更新了 modelcontextprotocol 官方的四个 MCP 服务端包：server-everything、server-filesystem、server-sequential-thinking 与 server-memory，版本号统一升至 2026.7.4。本次更新未披露具体的功能改动或问题修复，主要是一次例行的版本对齐，建议已使用这几个官方服务端的用户升级以保持依赖一致性。
