release: promote TypeMCP 0.2.2 examples remediation

README.md

@@ -32,9 +32,7 @@ These examples show declaration and adapter boundaries, not a full hosted applic
 
 ## Dependency-security boundary
 
-The published `@theorvane/type-mcp` package currently exact-pins an MCP SDK release whose transitive `@hono/node-server` graph is affected by [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9). This **examples application** uses an npm `overrides` entry to resolve its lockfile to `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the resulting production graph.
-
-This override is intentionally scoped to this repository and is **not a remediation for downstream TypeMCP consumers**. The package-level remediation remains tracked in [Theorvane/type-mcp#93](https://github.com/Theorvane/type-mcp/issues/93).
+These examples use the published `@theorvane/type-mcp@^0.2.2` remediation. Its consumer-enforceable dependency contract resolves `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the installed production graph with no local npm override.
 
 ## Development
 
@@ -49,7 +47,7 @@ npm run check
 ## Packages
 
 - [`@theorvane/type-chain`](https://www.npmjs.com/package/@theorvane/type-chain) `0.1.1`
-- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.0`
+- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.2` or later within the `0.2.x` range
 
 ## License
 

package.json

@@ -23,7 +23,7 @@
 	"dependencies": {
 		"@langchain/core": "^1.2.3",
 		"@theorvane/type-chain": "^0.1.1",
-		"@theorvane/type-mcp": "^0.2.0",
+		"@theorvane/type-mcp": "^0.2.2",
 		"langchain": "^1.5.4",
 		"zod": "^4.4.3"
 	},
@@ -33,10 +33,5 @@
 		"tsx": "^4.21.0",
 		"typescript": "^5.9.3",
 		"vitest": "^4.1.0"
-	},
-	"overrides": {
-		"@theorvane/type-mcp": {
-			"@modelcontextprotocol/sdk": "1.30.0"
-		}
 	}
 }

test/dependency-security.test.ts

@@ -10,25 +10,19 @@ type Lockfile = {
 };
 
 describe("production dependency security", () => {
-	it("pins the examples application to the audited MCP SDK graph", () => {
+	it("uses the published TypeMCP remediation without a local override", () => {
 		const packageJson = JSON.parse(
 			readFileSync(resolve(repositoryRoot, "package.json"), "utf8"),
 		) as {
-			readonly overrides?: {
-				readonly "@theorvane/type-mcp"?: {
-					readonly "@modelcontextprotocol/sdk"?: string;
-				};
+			readonly dependencies?: {
+				readonly "@theorvane/type-mcp"?: string;
 			};
 		};
 		const lockfile = JSON.parse(
 			readFileSync(resolve(repositoryRoot, "package-lock.json"), "utf8"),
 		) as Lockfile;
 
-		expect(
-			packageJson.overrides?.["@theorvane/type-mcp"]?.[
-				"@modelcontextprotocol/sdk"
-			],
-		).toBe("1.30.0");
+		expect(packageJson.dependencies?.["@theorvane/type-mcp"]).toBe("^0.2.2");
 		expect(
 			lockfile.packages["node_modules/@modelcontextprotocol/sdk"]?.version,
 		).toBe("1.30.0");