---
summary: "mcp-ts-core 0.10.9 maintenance — floating-specifier and plugin-manifest devcheck guards, 14 skill syncs, dependency refresh"
breaking: false
security: false
---

# 2.7.3 — 2026-06-20

## Added

- **`check-dependency-specifiers` devcheck step** — `scripts/check-dependency-specifiers.ts` (registered in `devcheck` as `Dependency Specifiers`, flag `--no-dep-specifiers`) hard-fails on floating specifiers (`latest`, `*`, pre-release dist-tags) in `package.json`'s dependency sections and `bun.lock`'s `workspaces` map. Catches `bun update --latest` writing a literal `latest` dist-tag into the lock that would re-resolve a held dep past its `package.json` range. Static and local — runs in the default and `--fast` passes. ([mcp-ts-core#246](https://github.com/cyanheads/mcp-ts-core/issues/246))
- **Plugin marketplace manifest checks in `lint:packaging`** — `scripts/lint-packaging.ts` validates `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and `.codex-plugin/mcp.json` for non-empty descriptions, unscoped machine name in display fields, and the full `package.json` name in the `npx -y` install arg. Gated by the new `devcheck.config.json` `packaging.pluginManifests` flag (default on); the `devcheck` Packaging gate now also runs when any plugin manifest is present. ([mcp-ts-core#240](https://github.com/cyanheads/mcp-ts-core/issues/240))

## Changed

- **`.codex-plugin/plugin.json`** — filled `interface.longDescription` (previously empty), satisfying the new plugin-manifest packaging lint.
- **`devcheck` git-dependent checks** — TODOs/FIXMEs, Tracked Secrets, and Framework Antipatterns now skip cleanly via a shared `isGitRepo()` guard when `.git` is absent (fresh scaffold before `git init`), instead of reporting `git`'s exit-128 as a failure. ([mcp-ts-core#243](https://github.com/cyanheads/mcp-ts-core/issues/243))
- **`scripts/build-changelog.ts`** — under `--check`, exits cleanly when `changelog/` holds no version files. ([mcp-ts-core#242](https://github.com/cyanheads/mcp-ts-core/issues/242))
- **`scripts/check-skill-versions.ts`** — skips a `SKILL.md` deleted from the worktree (`existsSync` guard) instead of crashing with ENOENT. ([mcp-ts-core#237](https://github.com/cyanheads/mcp-ts-core/issues/237))
- **14 `skills/<name>/SKILL.md` syncs** — `add-tool` 2.15, `api-auth` 1.2, `api-canvas` 1.7, `api-config` 1.8, `api-context` 1.9, `api-errors` 1.7, `api-services` 1.4, `api-telemetry` 1.2, `field-test` 2.6, `git-wrapup` 1.4, `orchestrations` 1.4, `polish-docs-meta` 2.9, `report-issue-local` 1.6, `tool-defs-analysis` 1.3. ([mcp-ts-core#238](https://github.com/cyanheads/mcp-ts-core/issues/238))

### Dependency bumps

- `@cyanheads/mcp-ts-core` ^0.10.6 → ^0.10.9
- `@cloudflare/workers-types` 4.20260613.1 → 4.20260620.1
- `@types/node` 25.9.3 → 26.0.0
- `@vitest/coverage-istanbul` ^4.1.8 → ^4.1.9
- `vitest` ^4.1.8 → ^4.1.9