[TheGreatAxios]

Background

@corbits/mcp 0.4.0 pins @corbits/credential-http at ^0.1.0 / 0.1.0 and @corbits/oauth-core at ^0.3.0 / 0.3.0 (with @intx/harness peer range ^0.4.0 || ^0.5.0). Published latest versions are @corbits/credential-http 0.1.3 (CL-11480) and @corbits/oauth-core 0.3.3 (CL-11479).

Outcome

• Bump @corbits/credential-http to ^0.1.3 (peerDependencies) and 0.1.3 (devDependencies)
• Bump @corbits/oauth-core to ^0.3.3 (peerDependencies) and 0.3.3 (devDependencies)
• Align @intx/harness in peerDependencies to ^0.5.0
• Bump package version to 0.4.1

Fixes CL-11509

[linear-code]

CL-11509

[corbits-triage]

Triage: Fail

@TheGreatAxios, please address the following:

• required checks are failing: check

Waiting on a maintainer to approve: request changes.

[TheGreatAxios]

Review · Request changes

Bumps @corbits/credential-http to 0.1.3 and @corbits/oauth-core to 0.3.3, and raises the oauth-core peer to ^0.3.3.

Findings

• package.json:105 — the peer @corbits/oauth-core is now ^0.3.3, while e2e/package.test.ts:63 and :82 still install 0.3.0 / 0.3.2 and expect the packed peer to stay ^0.3.0. CI job 121428406249 passed bun run check and failed bun run test:e2e with npm ERESOLVE. A local stub of the same peer range also rejected @corbits/oauth-core@0.3.2. Hosts still on 0.3.0–0.3.2 cannot install @corbits/mcp@0.4.1 without --legacy-peer-deps. The lockfile itself is consistent: bun install --frozen-lockfile exited 0. Either move those e2e pins and the expected peer range up to 0.3.3, or keep a peer range that still accepts the versions the test installs.

• Commit subject is 84 characters (chore(deps): bump @corbits/credential-http to 0.1.3 and @corbits/oauth-core to 0.3.3). A subject under 72 would match the repo line limit, for example chore(deps): bump oauth-core to 0.3.3.

[TheGreatAxios]

Review · Follow-up

The e2e pins now match the peer bump.

e2e/package.test.ts installs @corbits/oauth-core@0.3.3 and expects the packed peer ^0.3.3. bun run test:package exited 0 (13 pass, 0 fail). The amended subject is 66 characters: chore(deps): bump credential-http to 0.1.3 and oauth-core to 0.3.3. Pushed as e365222.

[TheGreatAxios]

Included in the 0.4.1 release (#33 if that is the release PR; see the release/0.4.1 PR that closes #32). Do not merge this PR separately.

[TheGreatAxios]

Included in #33. Do not merge this pull request separately.

[TheGreatAxios]

Superseded by the 0.4.1 release: #33