Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Release script skips version bump for packages with only lockfile changes

Open Beginner friendly
  • Is something wrong?
#3,870 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@haosenwang1018 is already working on this.

Since Apr 11, 2026.

  • #3892 by @JosephDoUrden — closed without merging
  • #3905 by @haosenwang1018 — open
  • #3969 by @Christian-Sidak — closed without merging
  • #4020 by @Will-hxw — closed without merging

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
python
Domain
build-system, release

Research direction

Start in scripts/release.py at has_changes() and inspect how changed files are filtered for package version bumps. Reproduce the 2026.1.14 to 2026.1.26 case with src/git/uv.lock, then verify that the release process updates src/git/pyproject.toml to version 2026.1.26 when the package directory has only lockfile changes.

Written by the indexing model from the issue text.

Description

bug

Describe the bug

has_changes() in scripts/release.py only considers .py and .ts files when deciding which packages to version-bump at release time:

relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts"]]
return len(relevant_files) >= 1

If a sub-package only has lockfile changes between tags (e.g. uv.lock from dependabot), the function returns False and the package's pyproject.toml version is never bumped to the CalVer tag. It keeps whatever stale version is on main.

To Reproduce

Between tags 2026.1.14 and 2026.1.26, the only change in src/git/ was uv.lock:

git diff --name-only 2026.1.14 2026.1.26 -- src/git/
# src/git/uv.lock

The release script skipped src/git/, so pyproject.toml stayed at 0.6.2:

git show 2026.1.26:src/git/pyproject.toml | grep '^version'
# version = "0.6.2"

git show 2026.1.14:src/git/pyproject.toml | grep '^version'
# version = "2026.1.14"

Expected behavior

src/git/pyproject.toml should read version = "2026.1.26" on the 2026.1.26 tag, since the package directory had changes included in that release.

Logs

N/A this is in the release automation, not a runtime issue.

Additional context

Downstream consumers (SBOM generators, CVE scanners) key off the version in pyproject.toml. When it says 0.6.2, advisories with CalVer "fixed in" thresholds never match, so scanners flag the package as vulnerable even though the source is identical to a patched release.

Dominant language
TypeScript
Stars
90.6k
Forks
11.7k
Avg merge
8h 36m
Merged PRs (30d)
23

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/servers

All issues in modelcontextprotocol/servers

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.