Release v0.5.2

[cmeans-claude-dev]

Summary

Cuts v0.5.2, shipping six PRs that landed since v0.5.1 (2026-05-01):

• fix(workflow): bump mcp-publisher v1.5.0 → v1.7.6 for registry OIDC audience #79 mcp-publisher v1.5.0 → v1.7.6 (registry OIDC audience fix)
• fix(auth): narrow keyring exception handler + log root cause #80 keyring exception handler narrowing (closes Keyring exception handler swallows all failures — narrow and log root cause #38)
• fix(server): bound bg update-check executor + log swallowed errors #81 bg update-check executor timeout + log (closes Background update-check task: log swallowed exceptions and add executor timeout #39)
• chore(deps): bump pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq, ReDoS) #82 pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq, ReDoS)
• fix(cli): validate version strings on --revert before pip handoff #83 --revert version-string validation (closes Validate version strings passed to --auto-upgrade and --revert #40)
• fix(filestation): per-path serial for move_files and copy_files #85 per-path serial for move_files + copy_files (closes move_files silently fails for multi-file moves (regression in v0.5.1) #84)

Why now

Two recent bug fixes (#83, #85) are user-visible enough to warrant shipping, and #84 in particular is a confusing silent-no-op regression on multi-file moves — getting that to PyPI promptly matters. The four post-0.5.1 quality fixes (#79–#82) are stacked behind it.

This release also exercises #79's mcp-publisher v1.7.6 pin end-to-end so the registry can catch up to current. v0.5.1's registry entry is missing because #79 landed AFTER the v0.5.1 tag-push, and actions/checkout@v6 resolved to the tag's commit on re-runs of the failed publish-registry job — the fix wasn't picked up. The v0.5.2 tag will pull the correct pin from main.

State after merge

Bug-labeled issue queue is empty. The structural multi-path-serial fix family (delete + getinfo + move + copy + restore) is now complete on real DSM 7.x — every File Station write tool that takes a paths: list[str] issues one DSM task per path, sidestepping the comma-joined-multipath quirk that #68 and #84 each surfaced.

Files changed

• pyproject.toml — version 0.5.1 → 0.5.2
• server.json — auto-synced via python scripts/sync-server-json.py
• uv.lock — refreshed via uv lock
• CHANGELOG.md — ## Unreleased (with the six entries above) renamed to ## 0.5.2 (2026-05-01), fresh empty ## Unreleased inserted above it for the next cycle

Test plan

• CI green on this branch (lint, typecheck, test 3.11/3.12/3.13, vdsm integration tests, version-sync, validate-server-json)
• After merge: tag v0.5.2 push fires publish.yml; PyPI publish succeeds
• After merge: publish-registry job succeeds end-to-end (this is the validation point for fix(workflow): bump mcp-publisher v1.5.0 → v1.7.6 for registry OIDC audience #79's fix — the failure mode in v0.5.1 was invalid audience: expected https://registry.modelcontextprotocol.io, got [mcp-registry])
• After tag: mcp-synology --check-update from a v0.5.1 install reports v0.5.2 available; uv tool install mcp-synology@latest upgrades cleanly
• Smoke (post-install): two-file move_files actually moves both files (the move_files silently fails for multi-file moves (regression in v0.5.1) #84 regression scenario)

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

LGTM

[cmeans]

QA Round 1 — PASS

Release rollup PR for v0.5.2 bundling six feature/fix PRs already QA-Approved in this cycle: #79 (mcp-publisher v1.7.6 OIDC pin), #80 (keyring narrowing, closes #38), #81 (bg update-check timeout, closes #39), #82 (pygments ReDoS), #83 (--revert validation, closes #40), #85 (per-path serial move/copy, closes #84). Per CLAUDE.md, release PRs don't need a QA section — code was tested in the feature PRs.

Mechanics verified

• Version bumps consistent: pyproject.toml 0.5.1→0.5.2; server.json BOTH top-level version AND packages[0].version 0.5.1→0.5.2; uv.lock mcp-synology entry 0.5.1→0.5.2. uv run python scripts/sync-server-json.py --check reports server.json in sync with pyproject.toml (0.5.2).
• CHANGELOG section split: Clean. Structure is now ## Unreleased (empty placeholder, line 3) → ## 0.5.2 (2026-05-01) (line 5) → ### Fixed (line 7) → six entries → ## 0.5.1 (2026-05-01) (line 16). Fresh empty ## Unreleased correctly placed above v0.5.2 for the next cycle.
• All six PRs in v0.5.2 section: grep -E '\(#79\)|\(#80\)|\(#81\)|\(#82\)|\(#83\)|\(#85\)' returns one hit per PR, all between line 7 (### Fixed) and line 16 (## 0.5.1) — none missing, none orphaned under ## Unreleased, none duplicated.
• publish.yml awk extractor (lines 117-122) uses $0 ~ "^## "version"( |\\()" which matches ## 0.5.2 (2026-05-01) exactly, then flag && /^## / {exit} walks until the next ## heading (= ## 0.5.1 (...)). Tag-push triggered post-merge will extract the v0.5.2 entries cleanly. (Previously verified for v0.5.1 in PR #78 — same pattern, same shape.)
• Diff scope: 4 files / +6 / -4. pyproject.toml +1/-1, server.json +2/-2, uv.lock +1/-1, CHANGELOG.md +2/-0 (the new heading + blank line). No surprise content.

Local verification on 89b9822

• uv run pytest → 581 passed, 112 deselected, 96.19% coverage. Matches the post-#85 baseline; no regression introduced by the version bump.
• uv run ruff check, ruff format --check, mypy src/ all clean.

CI

12/12 required checks green: lint, version-sync, validate-server-json, typecheck, test (3.11/3.12/3.13), vdsm integration tests SUCCESS (the registry of all post-#85 changes still passes against DSM 7.2.2).

Post-merge expectations (Dev / maintainer)

The remaining four checkboxes in the test plan are post-merge validation points, deliberately left unchecked per the test-plan structure:

• Tag-push fires publish.yml; PyPI publish.
• publish-registry job succeeds end-to-end — this is the actual validation point for #79's mcp-publisher v1.7.6 audience pin. v0.5.1's registry entry is missing because #79 landed AFTER the v0.5.1 tag-push; v0.5.2's tag will exercise the fix on a fresh checkout that does have the v1.7.6 pin.
• mcp-synology --check-update from a v0.5.1 install reports v0.5.2 available.
• Two-file move_files smoke against real NAS exercises #85's fix.

Disposition

Ready for QA Signoff applied as the final act. CI checkbox flipped (the only pre-merge one). Awaiting maintainer's QA Approved.

[cmeans]

Applying Ready for QA Signoff — release rollup mechanics verified clean. Version bumps consistent across pyproject.toml/server.json/uv.lock; sync-server-json.py --check passes; CHANGELOG split correctly inserts ## 0.5.2 (2026-05-01) between empty ## Unreleased and the existing ### Fixed; all six bundled PRs (#79, #80, #81, #82, #83, #85) under the new heading; publish.yml awk extractor will pick up the new section cleanly. Local 581/96.19% (post-#85 baseline preserved); ruff/format/mypy clean; CI 12/12 green incl. vdsm SUCCESS. Pre-merge CI checkbox flipped; remaining 4 checkboxes are post-merge validation per the test plan.