[dangrondahl]

Bumps the version to 0.8.0 with npm version minor --no-git-tag-version. That moves package.json, package-lock.json and src/version.ts together.

Why minor

The catalog gained three actions since v0.7.0 (#119, #121): get_evaluation_input, get_evaluation_input_trail_schema_v1 and get_evaluation_input_trails_schema_v1. None were removed.

Also in this release

• The .mcpb bundle now has GitHub build provenance (ci: attest GitHub build provenance for the .mcpb bundle #122) and a CycloneDX SBOM. The SBOM is attached to the GitHub Release, attested to GitHub and to Kosli, and checked against the bundle in CI (ci: publish and attest a CycloneDX SBOM for the .mcpb bundle #123). This is the first release to run those steps.
• @modelcontextprotocol/sdk 1.32.1 → 1.32.2 (chore: bump @modelcontextprotocol/sdk from 1.32.1 to 1.32.2 in the sdk group #116). There are also dev-only and CI dependency bumps (ci: bump the actions group with 3 updates #117, chore: bump node-forge from 1.4.0 to 1.4.2 #118, ci: bump the actions group with 2 updates #120).

Checked locally

• npm test passes (154/154), and so do build and typecheck.
• The .mcpb bundle was packed at 0.8.0. Its manifest says 0.8.0, mcpb validate passes, and the smoke test reports the server advertising 0.8.0.
• The SBOM check passes: it lists all 92 bundled packages and nothing else.
• npm audit --omit=dev: 0 vulnerabilities.

The smoke test's live read was skipped because no token was set.

After merge: tag the merge commit with git tag -a v0.8.0 -m "v0.8.0" && git push origin v0.8.0.

[claude]

Claude finished @dangrondahl's task in 1m 2s —— View job

---

Review: version bump to 0.8.0

Checked this against the release procedure in CLAUDE.md. No findings — looks good to merge.

What I verified

Check	Result
The three files move together	✅ package.json, both version keys in package-lock.json, and VERSION in src/version.ts all read 0.8.0 — no drift for test/version.test.ts to catch
manifest.json left alone	✅ still "0.0.0-replaced-at-build-time"; the pack script injects the real version
src/version.ts not hand-edited	✅ the diff is exactly what scripts/sync-version.mjs produces — only the VERSION literal, header comment intact
No stray 0.7.0 left	✅ the only remaining hits are unrelated transitive deps (chardet, iconv-lite) in the lockfile
Scope	✅ nothing beyond the three release-bump files
Conventional Commits	✅ chore: bump version to 0.8.0, single commit, matches the PR title

The minor-vs-patch call

Confirmed against the tag rather than taking the description's word for it — git diff v0.7.0..HEAD -- src/catalog.json adds exactly three action ids and removes none:

+ "id": "get_evaluation_input"
+ "id": "get_evaluation_input_trail_schema_v1"
+ "id": "get_evaluation_input_trails_schema_v1"

New capability, nothing dropped → minor is the right bump. The only other src/ change since v0.7.0 is src/version.ts itself; the SDK 1.32.1 → 1.32.2 bump is lockfile-only, which is what ^1.29.0 in package.json implies.

CI

CI is green. CodeQL and this review job were still in progress when I checked — worth a glance before tagging, since on pushes to main CodeQL's attest job fails while a high/critical alert is open.

One note for after merge, not a change request: this is the first release to exercise the new provenance and SBOM steps in release.yml (#122, #123), so the tag push is the first real run of scripts/check-mcpb-sbom.mjs and the kosli attest sbom step against a real tag. The description says both were checked locally, which is the right precaution. Tag the merge commit, not the branch head: git tag -a v0.8.0 -m "v0.8.0" && git push origin v0.8.0.

Nicely evidenced PR — citing the local bundle pack, the SBOM package count and npm audit made the non-obvious parts of this release verifiable rather than assumed.
· branch chore/release-0.8.0