[felixweinberger]

Summary

Changes the changeset from #2877 from patch to minor, so the next release is 2.5.0 rather than 2.4.1. #2877 adds skipOfflineAccessConsentPrompt to the public OAuthClientProvider type and startAuthorization(), and VERSIONING.md makes new backward-compatible features minor. #3085 added an opt-in provider member in the same way and shipped as minor.

The fixed group moves together, so server, core, server-legacy and codemod also go to 2.5.0.

Test plan

Ran changeset version (2.30.0, the locked version) on a copy of main, with the changelog generator turned off, once per bump level.

• Patch: the fixed group goes to 2.4.1.
• Minor: the fixed group goes to 2.5.0.
• Both: core-internal goes to 2.0.6, and express, fastify, hono and node do not move.

The workspace install and test suite were not run, and this change touches no runtime code.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2664d93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Minor
@modelcontextprotocol/codemod	Minor
@modelcontextprotocol/core	Minor
@modelcontextprotocol/server-legacy	Minor
@modelcontextprotocol/server	Minor
@modelcontextprotocol/core-internal	Patch

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3135

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3135

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3135

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3135

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3135

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3135

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3135

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3135

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3135

commit: 2664d93

[claude]

I reviewed this PR and found no bugs. Because the one-line change decides the next release number for the whole fixed group (2.5.0 instead of 2.4.1) and the path falls under the repo-wide CODEOWNERS rule, a maintainer's sign-off is still worthwhile.

What was reviewed:

• Bump level: skipOfflineAccessConsentPrompt is a new optional member on OAuthClientProvider and a new startAuthorization() option in packages/client/src/client/auth.ts, which VERSIONING.md classes as a backward-compatible feature, so minor fits.
• Changeset text against the code: the option is only read in the !skipOfflineAccessConsentPrompt && scope includes offline_access guard, so "default behavior is unchanged" holds.
• Knock-on bumps: express, fastify, hono and node peer on @ modelcontextprotocol/server with workspace:^, and .changeset/config.json sets onlyUpdatePeerDependentsWhenOutOfRange, so 2.5.0 stays in range and should not force majors there. I did not run changeset version myself.

Extended reasoning...

The diff changes one line in .changeset/skip-offline-access-consent-prompt.md, moving the @ modelcontextprotocol/client bump from patch to minor; no source, test or docs files change. It touches no security-sensitive runtime surface itself, although the feature it releases is in the OAuth client flow that is already on the base branch. The bump matches VERSIONING.md and the changeset text matches the code. I deferred rather than approved because .github/CODEOWNERS assigns every path to the typescript-sdk team and because the release level for the five fixed-group packages is a maintainer decision.