Both MCP OAuth flows previously tracked in-flight callback aborts using module-level new Map() globals shared across the process. Those globals are gone; abort tracking and registration now live on a per-session object property instead, so a new session no longer inherits pending OAuth callback listeners left over from another session.
MCP OAuth callback listeners moved off module-level maps onto a session-scoped registry
MCP OAuth callback tracking moved from shared global maps to per-session state
Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
MCPArea: what it touches
Internal ChangesKind: in v2.1.235,
Internal ChangesSection of the release