#3440)

The streamable-http job started the server with `go run` and relied on
mcp-server-diff's fixed http_startup_wait_ms sleep. On the baseline
worktree (.mcp-diff-base) nothing is cached, and since the typed tool
refactors compile+link exceeds 5s, so every baseline probe hit
ECONNREFUSED ("fetch failed"). The action treats a one-sided startup
failure as a non-fatal "config-missing" and diffs against an empty
baseline, so fail_on_error never triggered and the job stayed green.

Build the binary in install_command (which completes on both sides
before the server starts) and start it directly, and add a step that
fails the job if any configuration did not start on either side.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Migrate internal imports, build linker symbols, installation docs, and generated license attribution to the /v2 module path.

BREAKING CHANGE: Go consumers must import github.com/github/github-mcp-server/v2.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Preserve advertised parameter header bindings in the SDK registration schema so Streamable HTTP rejects header/body mismatches before receiving middleware. Keep full body validation and defaults behind tool guards, with unchanged advertised schemas and OAuth finalization.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bumps [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) from 2.2.0 to 2.3.1.
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.2.0...@modelcontextprotocol/client@2.3.1)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/client"
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#3461)

Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.1.1 to 6.1.2.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: Iryna Kulakova <52420926+IrynaKulakova@users.noreply.github.com>

…ntents (#3419)

The Contents API returns files over 1 MB with an empty content field and encoding "none". Since the symlink read checks, get_file_contents tried to decode that content and failed with "unsupported content encoding: none" before reaching the large-file branch. Treat that response as content not available so the tool returns the resource link again.

Co-authored-by: Iryna Kulakova <52420926+IrynaKulakova@users.noreply.github.com>

* Return every label from list_label instead of the first 100

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8a9000c-ebe8-4118-ae89-a942861e4166

* Page list_label with cursors instead of fetching every label

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8a9000c-ebe8-4118-ae89-a942861e4166

* Match list_issues wording in the list_label description

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8a9000c-ebe8-4118-ae89-a942861e4166

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d8a9000c-ebe8-4118-ae89-a942861e4166

* upgrade to Go 1.27.3 for compromised CA mitigation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3c4f7224-1f03-44c2-ab67-db76f7c8eceb

* isolate HTTP transports in parallel tests

Use the existing per-test transport helper so httptest server cleanup cannot close another test's shared default connections.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3c4f7224-1f03-44c2-ab67-db76f7c8eceb

* remove unused CodeQL environment resolution

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3c4f7224-1f03-44c2-ab67-db76f7c8eceb

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3c4f7224-1f03-44c2-ab67-db76f7c8eceb