π‘οΈ Proactive Technology Lifecycle Management for MCP Server
π¦ Current Stack Maintenance β’ π Node.js New Release Model β’ β‘ Future-Ready Architecture
π Document Owner: CEO | π Version: 3.2 | π
Last Updated: 2026-05-05 (UTC)
π Review Cycle: Annual | β° Next Review: 2027-04-21
π·οΈ Classification: Public (Open Source MCP Server)
The European Parliament MCP Server will maintain its current technology stack, utilizing modern TypeScript/Node.js with the MCP SDK, following Hack23 AB's "Living on the Edge" philosophy β maintaining latest stable releases with comprehensive automated testing and security validation.
This strategy aligns with Hack23 AB's Vulnerability Management Policy.
| Dimension | Level | EOL Impact | Rationale |
|---|---|---|---|
| π Confidentiality | Low | Open source, public data | |
| π Integrity | Medium | Data accuracy matters | |
| β‘ Availability | Medium | Tolerates maintenance windows |
graph TB
subgraph "ποΈ Core Runtime"
NODE[Node.js 26.x Current]
TS[TypeScript 6.0.3]
end
subgraph "π¦ Key Dependencies"
MCP["@modelcontextprotocol/sdk"]
ZOD[Zod 4.x]
end
subgraph "π§ͺ Testing"
VIT[Vitest]
end
subgraph "π§ Build & Distribution"
NPM[npm Registry]
GHA[GitHub Actions]
TSC[tsc Compiler]
end
NODE --> TS --> MCP & ZOD
TS --> TSC --> NPM
VIT --> GHA
| Component | Current Version | EOL Date | Risk Level | Migration Path |
|---|---|---|---|---|
| Node.js | >=26.0.0 (26.x Current) | April 2029 | π’ Low | Node.js 26 is the current stable release (released April 22, 2026). LTS promotion October 2026; 36-month runway. |
| Node.js 27 | Releasing April 2027 (nightly testing) | April 2030 | π’ Low | New annual release model; every release becomes LTS. Nightly builds tested in CI. |
| TypeScript | 6.0.3 | Active | π’ Low | Stay on 6.0.x until the next supported minor |
| MCP SDK | Latest | Active | π‘ Medium | Track protocol evolution |
| Zod | ^4.3.6 (4.x) | Active | π’ Low | Follow semver updates |
| Vitest | Latest | Active | π’ Low | Follow semver updates |
| npm | Registry | Indefinite | π’ Low | N/A |
| GitHub Actions | Latest | Indefinite | π’ Low | Pin action versions |
β Node.js 26 is now the active production runtime. Node.js 25 (odd-numbered Current-only release) reached EOL on April 22, 2026 when Node.js 26 released. Migration completed. β TypeScript 6.0.3 is now the active compiler baseline. TypeScript 5.9.x is retained only as the previous stable line and is no longer part of the active toolchain.
| Event | Date | Action Required |
|---|---|---|
| Node.js 25 EOL | April 22, 2026 β | COMPLETED β Upgraded to Node.js 26 |
| Node.js 26 release | April 22, 2026 β | COMPLETED β engines field and CI/CD updated |
| Node.js 26 LTS promotion | October 2026 | Confirmed long-term support; 36-month runway confirmed |
| Node.js 26 maintenance | October 2028 | Security-only updates; begin evaluating Node.js 27 |
| Node.js 27 Alpha opens | October 2026 | Begin CI testing on alpha channel (new release model) |
| Node.js 27 Current release | April 2027 | Stabilization; evaluate for production (new model: every release = LTS) |
| Node.js 27 LTS promotion | October 2027 | Begin production migration if Node.js 26 maintenance window is undesirable |
| Node.js 26 EOL | April 2029 | Must have migrated to Node.js 27+ |
| Node.js 28 Alpha opens | October 2027 | Monitor for early testing |
| Node.js 28 Current release | April 2028 | Next annual release (new model) |
| Node.js 27 EOL | April 2030 | 36 months total support |
Note: Starting with Node.js 27, the release schedule changes to one major release per year with every release becoming LTS. See Node.js Release Schedule Evolution for details.
In March 2026, the Node.js project announced a fundamental change to its release schedule, effective from October 2026. This section documents the impact on the European Parliament MCP Server's lifecycle management.
| Aspect | Old Model (β€ Node.js 26) | New Model (β₯ Node.js 27) |
|---|---|---|
| Major releases per year | 2 (April + October) | 1 (April) |
| LTS eligibility | Even-numbered only | Every release |
| Odd-numbered releases | Current only (no LTS) | N/A β distinction removed |
| LTS promotion | October (even releases) | October (all releases) |
| Total support lifetime | ~30 months (LTS only) | 36 months (Current + LTS) |
| Alpha channel | None | New: OctβMar, semver-major allowed |
| Version numbering | Sequential (24, 25, 26β¦) | Calendar-year aligned (27 in 2027, 28 in 2028) |
| Phase | Duration | Description |
|---|---|---|
| Alpha | 6 months (Oct β Mar) | Early testing, semver-major changes allowed |
| Current | 6 months (Apr β Oct) | Stabilization, no new breaking changes |
| LTS | 30 months (Oct β EOL) | Long-term support with security fixes |
| EOL | β | No further support |
| Total support | 36 months | From first Current release to End of Life |
| Impact Area | Assessment | Action |
|---|---|---|
| Upgrade frequency | π’ Positive | One major upgrade/year instead of two evaluation cycles |
| LTS availability | π’ Positive | Every release becomes LTS β no more skipping odd versions |
| Alpha testing | π‘ Requires action | Must integrate alpha channel into CI for early bug detection |
| Planning predictability | π’ Positive | Calendar-year versioning simplifies upgrade scheduling |
| Support window | π’ Positive | 36-month total support provides longer runway |
| Library compatibility | π‘ Monitor | Library authors encouraged to test on alpha early |
gantt
title Node.js Release Lifecycle β Old vs. New Model
dateFormat YYYY-MM-DD
axisFormat %Y-%m
section Historical (Node.js 25 β Odd/Current Only β EOL)
Node.js 25 Current :done, n25c, 2025-10-28, 2026-04-22
Node.js 25 EOL :crit, milestone, n25eol, 2026-04-22, 0d
section Current Production (Node.js 26 β Last Even/LTS)
Node.js 26 Current :active, n26c, 2026-04-22, 2026-10-28
Node.js 26 LTS :n26lts, 2026-10-28, 2029-04-30
Node.js 26 EOL :crit, milestone, n26eol, 2029-04-30, 0d
section New Model (Node.js 27)
Node.js 27 Alpha :n27a, 2026-10-01, 2027-03-31
Node.js 27 Current :n27c, 2027-04-01, 2027-10-01
Node.js 27 LTS :n27lts, 2027-10-01, 2030-04-01
Node.js 27 EOL :crit, milestone, n27eol, 2030-04-01, 0d
section New Model (Node.js 28)
Node.js 28 Alpha :n28a, 2027-10-01, 2028-03-31
Node.js 28 Current :n28c, 2028-04-01, 2028-10-01
Node.js 28 LTS :n28lts, 2028-10-01, 2031-04-01
Node.js 28 EOL :crit, milestone, n28eol, 2031-04-01, 0d
section EP MCP Server Strategy
Production on Node.js 25 (EOL) :done, ep25, 2025-10-28, 2026-04-22
Upgrade to Node 26 (COMPLETED) :done, ep26upgrade, 2026-04-22, 2026-05-05
Production on Node.js 26 :active, ep26, 2026-05-05, 2027-10-01
Nightly 27 CI Testing :active, ep27nightly, 2026-05-05, 2027-04-01
Alpha 27 CI Testing :ep27alpha, 2026-10-01, 2027-04-01
Node.js 27 Evaluation :ep27eval, 2027-04-01, 2027-10-01
Production on Node.js 27 :ep27prod, 2027-10-01, 2030-04-01
Alpha 28 CI Testing :ep28alpha, 2027-10-01, 2028-04-01
Source: Evolving the Node.js Release Schedule β see also nodejs/Release#1113 for background discussion.
Following the "Living on the Edge" philosophy from Vulnerability Management Policy:
continue-on-error: true)β Node.js 26 upgrade COMPLETED (May 2026). Node.js 25 (odd-numbered, Current-only) reached End-of-Life on April 22, 2026. Migration documented in the Node.js 25 β 26 Transition Plan below.
Phase 1 β Alpha Testing (OctβMar, 6 months before release)
1. Add Node.js alpha to CI matrix (non-blocking)
2. Report upstream bugs found during testing
3. Track dependency compatibility with alpha
Phase 2 β Current Evaluation (AprβOct, pre-LTS)
4. Promote alpha CI jobs to required status
5. Run full test suite (unit + E2E) on Current release
6. Benchmark performance against current LTS
7. Review breaking changes and update code as needed
Phase 3 β LTS Migration (Oct, on LTS promotion)
8. Update engines field in package.json
9. Update GitHub Actions workflow matrix
10. Run: npm install (rebuild native modules if any)
11. Run: npm run test:all && npm run lint (full validation)
12. Update documentation (README, DEVELOPER_GUIDE, this EOL Strategy)
13. Publish new npm version
β Node.js 26 upgrade COMPLETED β Executed May 2026. Node.js 25 (odd-numbered, Current-only) reached EOL on April 22, 2026 when Node.js 26 released.
| Phase | Timeline | Actions | Risk |
|---|---|---|---|
| Historical Production | Oct 2025 β Apr 2026 | Node.js 25.x Current in production | β COMPLETED |
| Day 0: Node.js 26 Release | April 22, 2026 | Updated package.json engines, all CI/CD workflows, devcontainer |
β COMPLETED |
| Validation | AprilβMay 2026 | Full test suite, lint, build on Node.js 26; published new npm version | β COMPLETED |
| Production on Node.js 26 | May 2026+ | Node.js 26 in production; Node.js 25 fully retired | β CURRENT |
| Node.js 26 LTS | October 2026 | LTS promotion confirmed; 36-month runway from April 2026 | π’ Upcoming |
Upgrade to Node.js 26 (COMPLETED β May 2026):
β
Step 1: Updated package.json engines: "node": ">=26.0.0"
β
Step 2: Updated all GitHub Actions workflows: node-version: "26"
β
Step 3: Updated .devcontainer/devcontainer.json: node version 26
β
Step 4: Updated documentation: README.md, DEVELOPER_GUIDE.md, LOCAL_TESTING.md, etc.
β
Step 5: Updated End-of-Life-Strategy.md: Technology Lifecycle Matrix and roadmap
β
Step 6: Updated WORKFLOWS.md, FUTURE_WORKFLOWS.md
β
Step 7: Ran: npm ci (rebuilt any native modules)
β
Step 8: Ran: npm test (full test suite β 1130+ unit tests and 71 E2E tests passed)
β
Step 9: Ran: npm run lint (zero warnings)
β
Step 10: Ran: npm run build (TypeScript compilation succeeded)
β
Step 11: Ran: npm run knip (no unused exports)
β
Step 12: Added Node.js 27 nightly to CI matrix (integration-tests.yml)
Next Steps:
β³ Step 13: Publish updated npm package with Node.js 26 as minimum engine
β³ Step 14: Verify npm package installs correctly on Node.js 26
β³ Step 15: Monitor CI/CD pipelines green on Node.js 26
| Phase | Timeline | Actions | Risk |
|---|---|---|---|
| Current Production | Apr 2026 β Oct 2027 | Node.js 26 LTS in production | π’ Low |
| Alpha 27 CI | Oct 2026 β Mar 2027 | Add 27.0.0-alpha.* to CI matrix (non-blocking) |
π’ Low |
| Current 27 Eval | Apr 2027 β Oct 2027 | Test on Node.js 27.x Current; fix compatibility issues | π‘ Medium |
| LTS 27 Migration | Oct 2027 | Upgrade production to Node.js 27 LTS | π‘ Medium |
| Node.js 26 Sunset | Apr 2029 | Node.js 26 reaches EOL; must be fully on 27+ | π’ Low (if planned) |
Per the Node.js project's guidance, library authors should integrate Alpha releases into CI as early as possible to report bugs before they affect users. As an npm-published MCP server, this project will:
continue-on-error: true) when Node.js 27 alpha opens in October 2026| Year | Node.js Version | Release Date | Phase | Action for this Project |
|---|---|---|---|---|
| 2025β2026 | 25.x | Oct 2025 | β EOL Apr 2026 | COMPLETED β upgraded to 26 |
| 2026 | 26.x | Apr 22, 2026 | β Current β LTS (Oct 2026) | CURRENT PRODUCTION β Node.js 27 nightly in CI |
| 2026 | 27.x Nightly | Active | π§ͺ Nightly builds | ACTIVE β nightly CI testing (continue-on-error: true) |
| 2026 | 27.x Alpha | Oct 2026 | Alpha | Add to CI matrix (non-blocking) |
| 2027 | 27.x | Apr 2027 | Current β LTS (Oct 2027) | Evaluate; new release model (every version = LTS) |
| 2027 | 28.x Alpha | Oct 2027 | Alpha | Add to CI matrix (non-blocking) |
| 2028 | 28.x | Apr 2028 | Current β LTS (Oct 2028) | Evaluate for migration from 27.x |
| 2029 | Node.js 26 EOL | Apr 2029 | β | Must be fully on 27+ before this date |
| 2029 | 29.x Alpha | Oct 2028 | Alpha | Add to CI matrix |
| 2030 | Node.js 27 EOL | Apr 2030 | β | Must be fully on 28+ before this date |
| 2031 | Node.js 28 EOL | Apr 2031 | β | Must be fully on 29+ before this date |
Note: Starting with Node.js 27 (released April 2027), the release schedule changes to one major release per year with every release becoming LTS. See Node.js Release Schedule Evolution for details.
| Tool | Purpose | Frequency |
|---|---|---|
| Dependabot | Dependency version updates | Daily |
| npm audit | Vulnerability scanning | Per CI/CD run |
| OpenSSF Scorecard | Project health monitoring | Weekly |
| GitHub Security Advisories | CVE notifications | Real-time |
| Activity | Frequency | Owner |
|---|---|---|
| Dependency audit | Quarterly | Development team |
| Node.js roadmap review | Semi-annual | Tech lead |
| MCP protocol evolution | Quarterly | Development team |
| EP API changes | Monthly | Development team |
| Phase | Version Range | Support Level |
|---|---|---|
| Active Development | Current major | Full support |
| Maintenance | Previous major | Security fixes only |
| Deprecated | Older versions | No support, deprecation notice |
| Archived | N/A | npm deprecation, GitHub archive |
npm deprecate with migration instructionsThe project reaches End-of-Life when any of the following occur:
| Trigger | Description | Impact |
|---|---|---|
| π MCP Protocol Obsolescence | MCP protocol replaced by successor | Architecture rewrite required |
| ποΈ EP API Discontinued | European Parliament data API shut down | Core functionality lost |
| π¦ Node.js Platform EOL | No supported Node.js LTS available | Runtime unavailable |
| π Unresolvable Security Issue | Critical vulnerability with no fix | Security risk unacceptable |
| π₯ Maintainer Unavailability | No active maintainers for > 12 months | No security updates |
Node.js 26 is the current production runtime (upgraded from Node.js 25 in May 2026). Node.js 26 is the last even-numbered release under the old model and will receive LTS promotion in October 2026. The upgrade procedure has been completed:
COMPLETED: Upgrade to Node.js 26 (May 2026):
β
Step 1: Updated package.json engines: "node": ">=26.0.0"
β
Step 2: Updated GitHub Actions workflows: node-version: "26"
β
Step 3: Updated .devcontainer: node version 26
β
Step 4: Ran: npm ci (rebuilt native modules if any)
β
Step 5: Ran: npm test (full test suite β 1130+ unit tests and 71 E2E tests)
β
Step 6: Ran: npm run lint (code quality check)
β
Step 7: Ran: npm run build (TypeScript compilation)
β
Step 8: Updated all documentation (README, DEVELOPER_GUIDE, this EOL Strategy)
β
Step 9: Added Node.js 27 nightly to integration-tests CI matrix
Starting with Node.js 27+, upgrades follow the new annual release cadence with a 6-month alpha β 6-month Current β 30-month LTS lifecycle:
Pre-Migration (Alpha Phase, OctβMar):
Step 1: Add alpha version to CI matrix as non-blocking job
Step 2: Monitor test failures and file upstream issues
Step 3: Track dependency compatibility reports
Migration (On LTS Promotion, October):
Step 4: Update package.json engines field to new LTS version
Step 5: Update GitHub Actions workflow (Node.js version matrix)
Step 6: Run: npm install (rebuild native modules if any)
Step 7: Run: npm test (full test suite β 1130+ unit tests and 71 E2E tests)
Step 8: Run: npm run lint (code quality check)
Step 9: Run: npm run build (TypeScript compilation)
Step 10: Update documentation (README, DEVELOPER_GUIDE, End-of-Life-Strategy.md)
Step 11: Publish new npm version
Post-Migration Validation:
Step 12: Verify npm package installs correctly on new Node.js version
Step 13: Test MCP client connectivity (stdio transport)
Step 14: Monitor production for 1 week before removing old Node.js from CI
Step 1: Update typescript dependency
Step 2: Review tsconfig.json for new options
Step 3: Fix any new type errors
Step 4: Run full test suite
Step 5: Publish patch release
Step 1: Review MCP SDK changelog for breaking changes
Step 2: Update @modelcontextprotocol/sdk dependency
Step 3: Update tool/resource registrations if needed
Step 4: Run E2E tests with MCP client
Step 5: Update API documentation
Step 6: Publish new version
| Item | Action | Status |
|---|---|---|
| npm deprecation notice | npm deprecate with message |
On EOL |
| GitHub repository archive | Set repository to archived | On EOL |
| README deprecation banner | Add clear deprecation notice | On EOL |
| Documentation preservation | Docs remain accessible | Permanent |
| Release artifacts | GitHub releases preserved | Permanent |
| SBOM records | Final SBOM archived | On EOL |
| ISMS Policy | Relevance | Link |
|---|---|---|
| π Vulnerability Management | "Living on the Edge" philosophy | Vulnerability_Management.md |
| π Secure Development | Technology lifecycle requirements | Secure_Development_Policy.md |
| π Backup & Recovery | Archive and preservation | Backup_Recovery_Policy.md |
| π·οΈ Classification | Impact-driven lifecycle decisions | CLASSIFICATION.md |
| π Open Source Policy | OSS governance and lifecycle | Open_Source_Policy.md |
| Document | Description | Link |
|---|---|---|
| π‘οΈ Security Architecture | Current security controls | SECURITY_ARCHITECTURE.md |
| π― Threat Model | Risk assessment | THREAT_MODEL.md |
| π Business Continuity Plan | Recovery procedures | BCPPlan.md |
| π° Financial Security Plan | Cost planning | FinancialSecurityPlan.md |
| β‘ Performance Testing | Benchmarks & analysis | performance-testing.md |
| ποΈ Architecture | System design | ARCHITECTURE.md |
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2026-02-20 | CEO | Initial EOL strategy β technology stack analysis, lifecycle matrix, dependency monitoring, migration procedures |
| 2.0 | 2026-03-12 | CEO | Major update: Node.js new release schedule (one major/year, every release LTS, alpha channel); added transition roadmap, Gantt timeline, release model comparison; updated version strategy for alpha CI integration; aligned with nodejs/Release#1113 |
| 3.0 | 2026-03-18 | CEO | Node.js 25 migration: Updated current production runtime to Node.js 25.x (Current); added urgent Node.js 26 upgrade plan (β April 22, 2026 β 2-week target); expanded full Node.js roadmap projections 2026β2031; updated Technology Lifecycle Matrix with Node.js 25 EOL risk; added Node.js 25 β 26 transition checklist; updated Gantt chart with Node.js 25 EOL and Node.js 26 LTS timeline |
| 3.1 | 2026-04-21 | CEO | Documentation review β verified accuracy of current state; confirmed Node.js 25 EOL is imminent (Node.js 26 releasing this week, β April 22, 2026); updated test count references from "2500+/2600+" to "1130+ unit tests and 71 E2E tests"; aligned references with ARCHITECTURE.md and WORKFLOWS.md |
| 3.2 | 2026-05-05 | CEO | Node.js 26 migration COMPLETED: Updated production runtime to Node.js 26.x; retired Node.js 25 (EOL April 22, 2026); updated Technology Lifecycle Matrix, Gantt chart, Key Dates, Version Strategy; added Node.js 27 nightly CI testing to integration-tests.yml matrix (continue-on-error: true); marked Node.js 25 β 26 transition checklist as completed |
This EOL strategy is maintained as part of the Hack23 AB ISMS framework.
Licensed under Apache-2.0