2.7.0

## What's Changed
* chore: bump the vitest trio to 4.1.11 past GHSA-82fw-gwwq-j7x9 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2315
* feat(test-servers): a CIMD showcase fixture that serves its own client metadata document by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2307
* chore: land the #2247 round-9 review findings on v2/main by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2322
* feat: bound every OAuth-path request with a deadline by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2324
* fix: bold the labels, not the values, and give Connection Info's URLs full width by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2329
* fix: exempt loopback hosts from the CIMD metadata URL HTTPS requirement by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2326
* fix: state every test-gate timeout instead of inheriting a library default by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2334
* fix: force the Storybook dep pre-bundle on every run (#2340) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2342
* chore: run each client's test suite once in local:gate, not twice by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2343
* feat: queue concurrent local:gate runs on a machine-wide lease (#2339) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2344
* docs: record why maxWorkers stays unset, with the measurement (#2336) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2345
* chore: state the smoke-helper and CI wall-clock budgets (#2333) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2349
* chore: remove gate-lease.test.mjs temp directories after the suite by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2351
* docs: stop justifying the asyncUtilTimeout pin by pointing at #2335 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2352
* fix: sample the SkillsScreen geometry only once the Frontmatter highlighter has landed by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2353
* docs: correct two stale gate comments after #2354 (gate-lease MAX_WAIT_MS, main.yml table pointer) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2357
* docs: bring quality-gate.md up to date after #2338 and document the gate lease by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2355
* chore(deps): bump ext-apps to 2.0.0 and drop the SDK-v1 shims by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2358
* chore: refresh the stale ext-apps example in the sdk-watch comments by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2361
* feat: bound connect attempts with a 30 s default connectionTimeout by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2362
* fix: reset relay request-response waits on progress notifications (#2028) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2363
* docs: add an environment-variable reference by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2366
* feat(core): report outstanding-request and notification-stream state on a request timeout (#2318) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2364
* fix: accept a path-less skill root URI in normalizeSkillUri by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2368
* feat: add --protocol-era launch flag for ad-hoc servers by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2372
* feat: make the skills verification catalog budget configurable per server (#2294) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2367
* fix: record an intercepted 401's status, headers and body in the network log by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2371
* feat(web): configurable public addresses for the MCP Apps listeners by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2370
* fix: report a gate-lease wait only when the run actually queued by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2375
* Declare the skills extension in the Inspector's client capabilities by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2374
* chore(release): bump to 2.7.0, audit clean, and fix sdk-watch suppression by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2379
* feat(test-servers): stall an OAuth endpoint so #2319's timeouts can be driven by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2383
* fix(test): AppRenderer theme flip — happy-dom drops GC'd MutationObserver callbacks by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2386
* docs: pack:verify is not a local:gate stage — name it as its own release step by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2387
* chore(release): merge v2/main into main for v2.7.0 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2381


**Full Changelog**: https://github.com/modelcontextprotocol/inspector/compare/2.6.0...2.7.0
Smoke test ledger for milestone branch: [v2/chore/milestone-merge-v2.7.0](https://claude.ai/artifact/XDxtD46ZkMZeFSN6xh6gKB) 

## Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

* @Avi-Jadhav03 (#2028)
* @eitansuez (#1862)
* @kraenhansen (#2208)
* @tulshi (#2297)