diff --git a/.changeset/bundled-fast-uri-3-1-9.md b/.changeset/bundled-fast-uri-3-1-9.md
deleted file mode 100644
index 0b1ea3dec6..0000000000
--- a/.changeset/bundled-fast-uri-3-1-9.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@modelcontextprotocol/client': patch
-'@modelcontextprotocol/server': patch
----
-
-The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected.
diff --git a/.changeset/protocol-instrumentation.md b/.changeset/protocol-instrumentation.md
deleted file mode 100644
index 9b72344d43..0000000000
--- a/.changeset/protocol-instrumentation.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@modelcontextprotocol/core-internal': minor
-'@modelcontextprotocol/client': minor
-'@modelcontextprotocol/server': minor
----
-
-`Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged.
-
-`@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`.
-
-What changes for applications that already run an OpenTelemetry SDK:
-
-- MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported.
-- Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only.
-- Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`.
-
-Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development.
diff --git a/.changeset/skip-offline-access-consent-prompt.md b/.changeset/skip-offline-access-consent-prompt.md
deleted file mode 100644
index 268cf233ef..0000000000
--- a/.changeset/skip-offline-access-consent-prompt.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@modelcontextprotocol/client': patch
----
-
-Add `OAuthClientProvider.skipOfflineAccessConsentPrompt` (and the matching `startAuthorization()` option) so a client can omit the `prompt=consent` the SDK adds when the requested scope includes `offline_access`. Default behavior is unchanged. This unblocks authorization servers such as Microsoft Entra ID tenants that have user consent disabled and admin consent granted, where a forced consent prompt fails with `AADSTS90095` for non-admin users.
diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md
index 2e6e11ff3b..7b3aa76c1f 100644
--- a/packages/client/CHANGELOG.md
+++ b/packages/client/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @modelcontextprotocol/client
 
+## 2.5.0
+
+### Minor Changes
+
+- [#3115](https://github.com/modelcontextprotocol/typescript-sdk/pull/3115) [`1e608ca`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1e608caeb5130b2ad0fa067c84b26a038c1c6e36) Thanks [@mattzcarey](https://github.com/mattzcarey)! - `Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged.
+
+    `@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`.
+
+    What changes for applications that already run an OpenTelemetry SDK:
+    - MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported.
+    - Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only.
+    - Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`.
+
+    Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development.
+
+### Patch Changes
+
+- [#3108](https://github.com/modelcontextprotocol/typescript-sdk/pull/3108) [`39ae8e6`](https://github.com/modelcontextprotocol/typescript-sdk/commit/39ae8e6192cf43273aaaf2de4169dfa9f7216e28) Thanks [@claude](https://github.com/apps/claude)! - The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected.
+
+- [#2877](https://github.com/modelcontextprotocol/typescript-sdk/pull/2877) [`b415e60`](https://github.com/modelcontextprotocol/typescript-sdk/commit/b415e60bdf0e8dd5d6cbe7e6353abfb982b06dd2) Thanks [@dasjideepak](https://github.com/dasjideepak)! - Add `OAuthClientProvider.skipOfflineAccessConsentPrompt` (and the matching `startAuthorization()` option) so a client can omit the `prompt=consent` the SDK adds when the requested scope includes `offline_access`. Default behavior is unchanged. This unblocks authorization servers such as Microsoft Entra ID tenants that have user consent disabled and admin consent granted, where a forced consent prompt fails with `AADSTS90095` for non-admin users.
+
+- Updated dependencies []:
+    - @modelcontextprotocol/core@2.5.0
+
 ## 2.4.0
 
 ### Minor Changes
diff --git a/packages/client/package.json b/packages/client/package.json
index 636456879d..25832b5249 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/client",
-    "version": "2.4.0",
+    "version": "2.5.0",
     "description": "Model Context Protocol implementation for TypeScript - Client package",
     "license": "Apache-2.0",
     "author": "Anthropic, PBC (https://anthropic.com)",
diff --git a/packages/codemod/CHANGELOG.md b/packages/codemod/CHANGELOG.md
index 87b2d64580..7994e29c49 100644
--- a/packages/codemod/CHANGELOG.md
+++ b/packages/codemod/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @modelcontextprotocol/codemod
 
+## 2.5.0
+
 ## 2.4.0
 
 ## 2.3.1
diff --git a/packages/codemod/package.json b/packages/codemod/package.json
index f8133d08d3..61d478bc68 100644
--- a/packages/codemod/package.json
+++ b/packages/codemod/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/codemod",
-    "version": "2.4.0",
+    "version": "2.5.0",
     "description": "Codemod to migrate MCP TypeScript SDK code from v1 to v2",
     "license": "Apache-2.0",
     "author": "Anthropic, PBC (https://anthropic.com)",
diff --git a/packages/core-internal/CHANGELOG.md b/packages/core-internal/CHANGELOG.md
index 9d9715f70b..3d9cd9816b 100644
--- a/packages/core-internal/CHANGELOG.md
+++ b/packages/core-internal/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @modelcontextprotocol/core-internal
 
+## 2.1.0
+
+### Minor Changes
+
+- [#3115](https://github.com/modelcontextprotocol/typescript-sdk/pull/3115) [`1e608ca`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1e608caeb5130b2ad0fa067c84b26a038c1c6e36) Thanks [@mattzcarey](https://github.com/mattzcarey)! - `Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged.
+
+    `@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`.
+
+    What changes for applications that already run an OpenTelemetry SDK:
+    - MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported.
+    - Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only.
+    - Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`.
+
+    Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development.
+
+### Patch Changes
+
+- Updated dependencies []:
+    - @modelcontextprotocol/core@2.5.0
+
 ## 2.0.5
 
 ### Patch Changes
diff --git a/packages/core-internal/package.json b/packages/core-internal/package.json
index 5e7612b729..a149e00b02 100644
--- a/packages/core-internal/package.json
+++ b/packages/core-internal/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@modelcontextprotocol/core-internal",
     "private": true,
-    "version": "2.0.5",
+    "version": "2.1.0",
     "description": "Model Context Protocol implementation for TypeScript - Core package",
     "license": "Apache-2.0",
     "author": "Anthropic, PBC (https://anthropic.com)",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 704b717ef8..39150d1cc8 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @modelcontextprotocol/core
 
+## 2.5.0
+
 ## 2.4.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index fbcf2818d9..aed507165f 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/core",
-    "version": "2.4.0",
+    "version": "2.5.0",
     "description": "Model Context Protocol for TypeScript — public Zod schemas (spec + OAuth/OpenID)",
     "license": "Apache-2.0",
     "author": "Anthropic, PBC (https://anthropic.com)",
diff --git a/packages/server-legacy/CHANGELOG.md b/packages/server-legacy/CHANGELOG.md
index abc7280e80..ae1ee05076 100644
--- a/packages/server-legacy/CHANGELOG.md
+++ b/packages/server-legacy/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @modelcontextprotocol/server-legacy
 
+## 2.5.0
+
+### Patch Changes
+
+- Updated dependencies []:
+    - @modelcontextprotocol/core@2.5.0
+
 ## 2.4.0
 
 ### Patch Changes
diff --git a/packages/server-legacy/package.json b/packages/server-legacy/package.json
index 039c771922..98d05d2f02 100644
--- a/packages/server-legacy/package.json
+++ b/packages/server-legacy/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@modelcontextprotocol/server-legacy",
     "private": false,
-    "version": "2.4.0",
+    "version": "2.5.0",
     "description": "Frozen v1 SSE transport and OAuth Authorization Server helpers for the Model Context Protocol TypeScript SDK. Deprecated; use StreamableHTTP and a dedicated OAuth server in production.",
     "deprecated": "This package is a frozen copy of v1's SSE transport and OAuth Authorization Server helpers for migration purposes only. Use StreamableHTTP from @modelcontextprotocol/server and a dedicated OAuth server in production. Will not receive new features.",
     "license": "Apache-2.0",
diff --git a/packages/server/CHANGELOG.md b/packages/server/CHANGELOG.md
index be1dcf91cb..e92df9e9c2 100644
--- a/packages/server/CHANGELOG.md
+++ b/packages/server/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @modelcontextprotocol/server
 
+## 2.5.0
+
+### Minor Changes
+
+- [#3115](https://github.com/modelcontextprotocol/typescript-sdk/pull/3115) [`1e608ca`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1e608caeb5130b2ad0fa067c84b26a038c1c6e36) Thanks [@mattzcarey](https://github.com/mattzcarey)! - `Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged.
+
+    `@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`.
+
+    What changes for applications that already run an OpenTelemetry SDK:
+    - MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported.
+    - Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only.
+    - Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`.
+
+    Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development.
+
+### Patch Changes
+
+- [#3108](https://github.com/modelcontextprotocol/typescript-sdk/pull/3108) [`39ae8e6`](https://github.com/modelcontextprotocol/typescript-sdk/commit/39ae8e6192cf43273aaaf2de4169dfa9f7216e28) Thanks [@claude](https://github.com/apps/claude)! - The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected.
+
+- Updated dependencies []:
+    - @modelcontextprotocol/core@2.5.0
+
 ## 2.4.0
 
 ### Minor Changes
diff --git a/packages/server/package.json b/packages/server/package.json
index b61acddc68..3982812070 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/server",
-    "version": "2.4.0",
+    "version": "2.5.0",
     "description": "Model Context Protocol implementation for TypeScript - Server package",
     "license": "Apache-2.0",
     "author": "Anthropic, PBC (https://anthropic.com)",