Release Notes

What breaks if I upgrade? Coding agents answer upgrade questions from memory, and memory is where "express 5 removed req.param() in 5.0.0" (it was 5.0.0-alpha.2) and "requests 2.32 is a drop-in update" (it dropped Python 3.7) come from. Release Notes answers from the package's own changelog:

• Before an upgrade, changes_between lists the breaking changes, removals, deprecations, security fixes and raised requirements (Node.js, Python...) between two versions, each tagged with its version, and says which major versions you cross. Pre-release notes count toward the release they lead to, which is where most breaking changes are written down.

• When did it change? search_changelog finds every version whose notes mention an API or option, oldest first, with the section it was listed under ("remove", "deprecations").

• One version's notes, cleaned of commit hashes and pull-request noise.

Notes come from the CHANGELOG file (a monorepo package's own first; Markdown, underlined and reStructuredText formats), or from GitHub releases when there is no file, or the file covers only the newest major. npm, PyPI, crates.io, Go, Maven and NuGet. No key needed; a GITHUB_TOKEN raises GitHub's limit of 60 anonymous API requests an hour.

Built and maintained by Arhan Canli.

Install

Needs Node.js 20 or newer. No account or key.

Claude Code

claude mcp add release-notes -- npx -y release-notes-mcp

Claude Desktop: download release-notes-mcp-<version>.mcpb from the latest release and open it. The bundle is signed; verify it with gh attestation verify <file> --repo arhancanli/release-notes-mcp.

Any other client (Windsurf, Zed, Cline, Continue and others), in its MCP config file:

{
  "mcpServers": {
    "release-notes": {
      "command": "npx",
      "args": [
        "-y",
        "release-notes-mcp"
      ]
    }
  }
}

Docker

docker build -t release-notes-mcp https://github.com/arhancanli/release-notes-mcp.git && docker run -i --rm release-notes-mcp

Hosted (Streamable HTTP): node src/server.mjs --http serves stateless MCP at POST /mcp (port from PORT, default 3000).

Related MCP server: Modelmeter

Example

An agent calls changes_between with:

{
  "ecosystem": "npm",
  "package": "express",
  "from": "4.21.2",
  "to": "5.0.0"
}

and gets back (recorded from the live server on 2026-09-26):

{
  "versions": 5,
  "major_upgrades": [
    "5.x"
  ],
  "from_date": "2024-12-05",
  "to_date": "2024-09-10",
  "breaking": [
    "5.0.0: `res.status()` accepts only integers, and input must be greater than 99 and less than 1000",
    "5.0.0: will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range",
    "5.0.0: will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs"
  ],
  "removed": [
    "5.0.0: `path-is-absolute` dependency - use `path.isAbsolute` instead",
    "5.0.0-beta.1: Named matching groups no longer available by position in `req.params`",
    "5.0.0-beta.1: Remove `debug` dependency",
    "5.0.0-beta.1: Remove `hidden` option; use `dotfiles` option instead",
    "5.0.0-beta.1: Remove `express.static.mime` export; use `mime-types` package instead",
    "5.0.0-alpha.7: `path-to-regexp` dependency",
    "5.0.0-alpha.7: Remove `DEBUG_FD` environment variable support",
    "5.0.0-alpha.6: `res.redirect(url, status)` signature - use `res.redirect(status, url)`",
    "5.0.0-alpha.6: `res.send(status, body)` signature - use `res.status(status).send(body)`",
    "5.0.0-alpha.4: Remove Express 3.x middleware error stubs",
    "5.0.0-alpha.3: `res.json(status, obj)` signature - use `res.status(status).json(obj)`",
    "5.0.0-alpha.3: `res.jsonp(status, obj)` signature - use `res.status(status).jsonp(obj)`",
    "5.0.0-alpha.3: `res.vary()` (no arguments) -- provide a field name as an argument",
    "5.0.0-alpha.2: `app.param(fn)`",
    "5.0.0-alpha.2: `req.param()` -- use `req.params`, `req.body`, or `req.query` instead",
    "5.0.0-alpha.1: `app.del` - use `app.delete`",
    "5.0.0-alpha.1: `req.acceptsCharset` - use `req.acceptsCharsets`",
    "5.0.0-alpha.1: `req.acceptsEncoding` - use `req.acceptsEncodings`",
    "5.0.0-alpha.1: `req.acceptsLanguage` - use `req.acceptsLanguages`",
    "5.0.0-alpha.1: `res.json(obj, status)` signature - use `res.json(status, obj)`",
    "5.0.0-alpha.1: `res.jsonp(obj, status)` signature - use `res.jsonp(status, obj)`",
    "5.0.0-alpha.1: `res.send(body, status)` signature - use `res.send(status, body)`",
    "5.0.0-alpha.1: `res.send(status)` signature - use `res.sendStatus(status)`",
    "5.0.0-alpha.1: `res.sendfile` - use `res.sendFile` instead",
    "5.0.0-alpha.1: `express.query` middleware"
  ],
  "requirements": [
    "5.0.0-beta.1: Requires Node.js 4+"
  ],
  "source": "https://github.com/expressjs/express/blob/HEAD/History.md",
  "without_notes": "4.22.0, 4.22.1, 4.22.2, 4.22.3",
  "package": "express",
  "from": "4.21.2",
  "to": "5.0.0"
}

Tools

How it behaves

• Read-only: no tool changes anything outside this process. Package names go to deps.dev, the npm registry and GitHub; nothing about your project is sent.

• Network: HTTPS only, to the hosts listed in package.json under factory.allowHosts, with a deadline, a size cap and bounded retries. Nothing else is contacted, and nothing is logged except unexpected failures (to stderr, without your inputs).

• Changelogs and release lists are cached for 30 minutes.

• Classification is by the notes' own words and section labels. A change a project did not write down as breaking is not flagged; major_upgrades names the major versions crossed regardless.

• Results are compact JSON with a matching output schema. Lists say how many items were left out.

Benchmark

Measured 2026-09-26 with gpt-5.4-mini, 9 fixed tasks graded by fixed checks (bench/tasks.json, raw results in bench/results/).

Performance

Measured 2026-09-26 from Dubai, home connection against the live upstream, Node 24.19.0 (bench/perf.json, scripts/perf.mjs in the factory).

First call: a fresh server process, including the TLS connection and the upstream's own time. Repeat: the same call again, answered from the in-process cache, so it shows this server's own overhead.

Tool definitions the model reads on every turn (name, description, input schema): 1,792 characters, against 1,105 for mcp-server-fetch reading changelogs (no changelog server exists; this is what agents use today). The full tool list, with the output schemas and annotations clients use to validate results, is 2,732 characters (1,104 for the alternative).

Data sources

• deps.dev (Open Source Insights) for versions, publish dates and repositories, and the npm registry for monorepo directories.

• The package's GitHub repository: its CHANGELOG file and GitHub releases.

More MCP servers by Arhan Canli

• Actions Check: Checks GitHub Actions workflows: outdated actions, old Node runtimes, retired runners, injection.

• Config Check: Validates config files against their official schemas: tsconfig, compose, workflows, 1,400+ more.

• Cron Check: Explains cron expressions, lists next run times in any time zone, converts between cron dialects.

• Dockerfile Check: Checks Dockerfiles: build-breaking mistakes, base image tags that exist, digests, platforms, EOL.

• Domain Health: Email and domain checks: SPF lookup limits, DKIM keys, DMARC, DNS records, registration expiry.

• End of Life: Is this version still supported? EOL dates, latest patch and upgrade target for 470+ products.

• Internet Standards: RFC sections, status, obsoleted-by chains, errata and IANA registries for coding agents.

• Kube Check: Checks Kubernetes manifests for your version: removed APIs, unknown fields, Pod Security, risks.

• The whole collection, 12 more

License

MIT, Copyright (c) 2026 Arhan Canli.