From 15dde3dc57851ed64010b2fa565559172895b43b Mon Sep 17 00:00:00 2001
From: J-Dog <j-dog@j-dog.net>
Date: Tue, 6 Oct 2026 11:54:40 -0700
Subject: [PATCH 1/3] chore(release): v0.22.7

---
 CHANGELOG.md      | 5 +++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 218f1786..f979764d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.22.7] - 2026-10-06
+
+### Changed
+- Pinned the v0.22.7 hub tag in the release manifest for the paged, backed-off peer catch-up fix.
+
 ## [0.22.6] - 2026-10-06
 
 ### Changed
diff --git a/package-lock.json b/package-lock.json
index 0f6a5476..7231fcb0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "xchain-node",
-  "version": "0.22.6",
+  "version": "0.22.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "xchain-node",
-      "version": "0.22.6",
+      "version": "0.22.7",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@dankest-llc/xchain-sdk": "^0.18.0",
diff --git a/package.json b/package.json
index 9a280b42..2c946222 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "xchain-node",
-  "version": "0.22.6",
+  "version": "0.22.7",
   "description": "xchain-node allows users to install, configure and run XChain platform nodes.",
   "license": "AGPL-3.0-or-later",
   "repository": {

From fd24aa81fff80b2939a079f0677d4e823303aaf8 Mon Sep 17 00:00:00 2001
From: J-Dog <j-dog@j-dog.net>
Date: Tue, 6 Oct 2026 12:43:19 -0700
Subject: [PATCH 2/3] Override the MCP SDK to 1.31.0 or later for
 GHSA-6qxp-vccf-f47h

---
 CHANGELOG.md      | 3 +++
 package-lock.json | 6 +++---
 package.json      | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f979764d..6a77fee1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - Pinned the v0.22.7 hub tag in the release manifest for the paged, backed-off peer catch-up fix.
 
+### Security
+- Raised the MCP SDK to 1.31.0 or later to clear advisory GHSA-6qxp-vccf-f47h.
+
 ## [0.22.6] - 2026-10-06
 
 ### Changed
diff --git a/package-lock.json b/package-lock.json
index 7231fcb0..33fe71f4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1360,9 +1360,9 @@
       }
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
-      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
+      "version": "1.32.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.1.tgz",
+      "integrity": "sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==",
       "license": "MIT",
       "dependencies": {
         "@hono/node-server": "^1.19.9 || ^2.0.5",
diff --git a/package.json b/package.json
index 2c946222..3ae69bff 100644
--- a/package.json
+++ b/package.json
@@ -64,7 +64,8 @@
     "js-yaml": "^4.3.1",
     "form-data": "^4.0.6",
     "ip-address": "^10.3.1",
-    "decimal.js": "10.4.3"
+    "decimal.js": "10.4.3",
+    "@modelcontextprotocol/sdk": "^1.31.0"
   },
   "bin": {
     "xchain-node": "./src/index.js"

From 718c54390a1d40db87fd03ebfa2e2059dbfd205f Mon Sep 17 00:00:00 2001
From: J-Dog <j-dog@j-dog.net>
Date: Tue, 6 Oct 2026 12:43:54 -0700
Subject: [PATCH 3/3] Release v0.22.7 manifest

---
 src/release-manifest.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/release-manifest.json b/src/release-manifest.json
index a2bddad6..82a13349 100644
--- a/src/release-manifest.json
+++ b/src/release-manifest.json
@@ -1,6 +1,6 @@
 {
     "_comment": [
-        "Pinned component set for XChain Platform v0.22.6.",
+        "Pinned component set for XChain Platform v0.22.7.",
         "Generated by bin/write-release-manifest.js from the ACTUAL tagged master merge commits.",
         "xchain-node is the carrier and is not listed: checking out its tag IS this manifest.",
         "A train tags only the repos it touches. This one moves xchain-hub.",
@@ -12,7 +12,7 @@
         "repo's origin/master, and is a GPG-signed annotated tag verifying against the",
         "platform release key (fingerprint 1DA7C4896F56EA22CF491EDF4361611A82F90B70)."
     ],
-    "platform_version": "0.22.6",
+    "platform_version": "0.22.7",
     "released": "2026-10-06",
     "components": {
         "xchain-vm": {
@@ -28,8 +28,8 @@
             "commit": "4ac2c37375d4b1e55d13ed081d723e1ef17537f2"
         },
         "xchain-hub": {
-            "tag": "v0.22.6",
-            "commit": "fdd50cc292cba54990e6ae5673c11b31fd31c72a"
+            "tag": "v0.22.7",
+            "commit": "52d1067d556f3d7590185872a1497796707359bb"
         },
         "xchain-sync": {
             "tag": "v0.22.4",