π‘οΈ Proactive Technology Lifecycle Management for MCP Server
π¦ Current Stack Maintenance β’ π Node.js New Release Model β’ β‘ Future-Ready Architecture
π Document Owner: CEO | π Version: 3.0 | π
Last Updated: 2026-03-18 (UTC)
π Review Cycle: Annual | β° Next Review: 2027-03-18
π·οΈ Classification: Public (Open Source MCP Server)
The European Parliament MCP Server will maintain its current technology stack, utilizing modern TypeScript/Node.js with the MCP SDK, following Hack23 AB's "Living on the Edge" philosophy β maintaining latest stable releases with comprehensive automated testing and security validation.
This strategy aligns with Hack23 AB's Vulnerability Management Policy.
| Dimension | Level | EOL Impact | Rationale |
|---|---|---|---|
| π Confidentiality | Low | Open source, public data | |
| π Integrity | Medium | Data accuracy matters | |
| β‘ Availability | Medium | Tolerates maintenance windows |
graph TB
subgraph "ποΈ Core Runtime"
NODE[Node.js 25.x Current]
TS[TypeScript 6.0.2]
end
subgraph "π¦ Key Dependencies"
MCP["@modelcontextprotocol/sdk"]
ZOD[Zod 4.x]
end
subgraph "π§ͺ Testing"
VIT[Vitest]
end
subgraph "π§ Build & Distribution"
NPM[npm Registry]
GHA[GitHub Actions]
TSC[tsc Compiler]
end
NODE --> TS --> MCP & ZOD
TS --> TSC --> NPM
VIT --> GHA
| Component | Current Version | EOL Date | Risk Level | Migration Path |
|---|---|---|---|---|
| Node.js | >=25.0.0 (25.x Current) | April 2026 π΄ | π΄ Imminent | Upgrade to Node.js 26 immediately on release (β April 2026) |
| Node.js 26 | Releasing April 2026 | April 2029 | π’ Low | Will be even-numbered LTS candidate; migrate within days of release |
| TypeScript | 6.0.2 | Active | π’ Low | Stay on 6.0.x until the next supported minor |
| MCP SDK | Latest | Active | π‘ Medium | Track protocol evolution |
| Zod | ^4.3.6 (4.x) | Active | π’ Low | Follow semver updates |
| Vitest | Latest | Active | π’ Low | Follow semver updates |
| npm | Registry | Indefinite | π’ Low | N/A |
| GitHub Actions | Latest | Indefinite | π’ Low | Pin action versions |
β οΈ Node.js 25 is an odd-numbered Current release (old release model). It has no LTS phase and reaches EOL when Node.js 26 releases in April 2026. Upgrade to Node.js 26 within days of its release. β TypeScript 6.0.2 is now the active compiler baseline. TypeScript 5.9.x is retained only as the previous stable line and is no longer part of the active toolchain.
| Event | Date | Action Required |
|---|---|---|
| Node.js 25 EOL | β April 2026 π΄ | Upgrade to Node.js 26 IMMEDIATELY on release |
| Node.js 26 release | β April 22, 2026 π΄ | Upgrade all CI/CD and engines field β target: within 2 days of release |
| Node.js 26 LTS promotion | October 2026 | Confirmed long-term support; 36-month runway confirmed |
| Node.js 26 maintenance | October 2028 | Security-only updates; begin evaluating Node.js 27 |
| Node.js 27 Alpha opens | October 2026 | Begin CI testing on alpha channel (new release model) |
| Node.js 27 Current release | April 2027 | Stabilization; evaluate for production (new model: every release = LTS) |
| Node.js 27 LTS promotion | October 2027 | Begin production migration if Node.js 26 maintenance window is undesirable |
| Node.js 26 EOL | April 2029 | Must have migrated to Node.js 27+ |
| Node.js 28 Alpha opens | October 2027 | Monitor for early testing |
| Node.js 28 Current release | April 2028 | Next annual release (new model) |
| Node.js 27 EOL | April 2030 | 36 months total support |
Note: Starting with Node.js 27, the release schedule changes to one major release per year with every release becoming LTS. See Node.js Release Schedule Evolution for details.
In March 2026, the Node.js project announced a fundamental change to its release schedule, effective from October 2026. This section documents the impact on the European Parliament MCP Server's lifecycle management.
| Aspect | Old Model (β€ Node.js 26) | New Model (β₯ Node.js 27) |
|---|---|---|
| Major releases per year | 2 (April + October) | 1 (April) |
| LTS eligibility | Even-numbered only | Every release |
| Odd-numbered releases | Current only (no LTS) | N/A β distinction removed |
| LTS promotion | October (even releases) | October (all releases) |
| Total support lifetime | ~30 months (LTS only) | 36 months (Current + LTS) |
| Alpha channel | None | New: OctβMar, semver-major allowed |
| Version numbering | Sequential (24, 25, 26β¦) | Calendar-year aligned (27 in 2027, 28 in 2028) |
| Phase | Duration | Description |
|---|---|---|
| Alpha | 6 months (Oct β Mar) | Early testing, semver-major changes allowed |
| Current | 6 months (Apr β Oct) | Stabilization, no new breaking changes |
| LTS | 30 months (Oct β EOL) | Long-term support with security fixes |
| EOL | β | No further support |
| Total support | 36 months | From first Current release to End of Life |
| Impact Area | Assessment | Action |
|---|---|---|
| Upgrade frequency | π’ Positive | One major upgrade/year instead of two evaluation cycles |
| LTS availability | π’ Positive | Every release becomes LTS β no more skipping odd versions |
| Alpha testing | π‘ Requires action | Must integrate alpha channel into CI for early bug detection |
| Planning predictability | π’ Positive | Calendar-year versioning simplifies upgrade scheduling |
| Support window | π’ Positive | 36-month total support provides longer runway |
| Library compatibility | π‘ Monitor | Library authors encouraged to test on alpha early |
gantt
title Node.js Release Lifecycle β Old vs. New Model
dateFormat YYYY-MM-DD
axisFormat %Y-%m
section Current (Node.js 25 β Odd/Current Only)
Node.js 25 Current :active, n25c, 2025-10-28, 2026-04-22
Node.js 25 EOL :crit, milestone, n25eol, 2026-04-22, 0d
section Legacy Model (Node.js 26 β Last Even/LTS)
Node.js 26 Current :n26c, 2026-04-22, 2026-10-28
Node.js 26 LTS :n26lts, 2026-10-28, 2029-04-30
Node.js 26 EOL :crit, milestone, n26eol, 2029-04-30, 0d
section New Model (Node.js 27)
Node.js 27 Alpha :n27a, 2026-10-01, 2027-03-31
Node.js 27 Current :n27c, 2027-04-01, 2027-10-01
Node.js 27 LTS :n27lts, 2027-10-01, 2030-04-01
Node.js 27 EOL :crit, milestone, n27eol, 2030-04-01, 0d
section New Model (Node.js 28)
Node.js 28 Alpha :n28a, 2027-10-01, 2028-03-31
Node.js 28 Current :n28c, 2028-04-01, 2028-10-01
Node.js 28 LTS :n28lts, 2028-10-01, 2031-04-01
Node.js 28 EOL :crit, milestone, n28eol, 2031-04-01, 0d
section EP MCP Server Strategy
Production on Node.js 25 :active, ep25, 2025-10-28, 2026-04-22
URGENT: Upgrade to Node 26 :crit, ep26upgrade, 2026-04-22, 2026-04-24
Production on Node.js 26 :ep26, 2026-04-22, 2027-10-01
Alpha 27 CI Testing :ep27alpha, 2026-10-01, 2027-04-01
Node.js 27 Evaluation :ep27eval, 2027-04-01, 2027-10-01
Production on Node.js 27 :ep27prod, 2027-10-01, 2030-04-01
Alpha 28 CI Testing :ep28alpha, 2027-10-01, 2028-04-01
Source: Evolving the Node.js Release Schedule β see also nodejs/Release#1113 for background discussion.
Following the "Living on the Edge" philosophy from Vulnerability Management Policy:
β οΈ URGENT ACTION REQUIRED: Node.js 25 (odd-numbered, Current-only) reaches End-of-Life when Node.js 26 releases in β 2 weeks (April 2026). Upgrade plan is documented in the Node.js 25 β 26 Transition Plan below.
Phase 1 β Alpha Testing (OctβMar, 6 months before release)
1. Add Node.js alpha to CI matrix (non-blocking)
2. Report upstream bugs found during testing
3. Track dependency compatibility with alpha
Phase 2 β Current Evaluation (AprβOct, pre-LTS)
4. Promote alpha CI jobs to required status
5. Run full test suite (unit + E2E) on Current release
6. Benchmark performance against current LTS
7. Review breaking changes and update code as needed
Phase 3 β LTS Migration (Oct, on LTS promotion)
8. Update engines field in package.json
9. Update GitHub Actions workflow matrix
10. Run: npm install (rebuild native modules if any)
11. Run: npm run test:all && npm run lint (full validation)
12. Update documentation (README, DEVELOPER_GUIDE, this EOL Strategy)
13. Publish new npm version
π΄ Node.js 25 EOL is imminent β it expires when Node.js 26 releases in β 2 weeks. Execute this plan immediately upon Node.js 26 release.
| Phase | Timeline | Actions | Risk |
|---|---|---|---|
| Current Production | Now (March 2026) | Node.js 25.x Current in production | π΄ HIGH β EOL in β2 weeks |
| Day 0: Node.js 26 Release | β April 22, 2026 | Update package.json engines, all CI/CD workflows, devcontainer |
π‘ Medium |
| Day 0β2: Validation | April 22β24, 2026 | Run full test suite, lint, build on Node.js 26; publish new npm version | π‘ Medium |
| Day 2+: Production | April 24, 2026+ | Node.js 26 in production; Node.js 25 fully retired | π’ Low |
| Node.js 26 LTS | October 2026 | LTS promotion confirmed; 36-month runway from April 2026 | π’ Low |
Day 0 β Upgrade (April 22, 2026, release day):
Step 1: Update package.json engines: "node": ">=26.0.0"
Step 2: Update all GitHub Actions workflows: node-version: "26"
Step 3: Update .devcontainer/devcontainer.json: node version 26
Step 4: Update documentation: README.md, DEVELOPER_GUIDE.md, LOCAL_TESTING.md, etc.
Step 5: Update End-of-Life-Strategy.md: Technology Lifecycle Matrix and roadmap
Step 6: Update WORKFLOWS.md, FUTURE_WORKFLOWS.md
Step 7: Run: npm ci (rebuild any native modules)
Step 8: Run: npm test (full test suite β 2600+ unit tests must pass)
Step 9: Run: npm run lint (zero warnings required)
Step 10: Run: npm run build (TypeScript compilation must succeed)
Step 11: Run: npm run knip (no unused exports)
Day 1 β Publish:
Step 12: Publish updated npm package with Node.js 26 as minimum engine
Step 13: Open PR with all version bumps and documentation updates
Step 14: Merge and tag new release
Day 2 β Validation:
Step 15: Verify npm package installs correctly on Node.js 26
Step 16: Test MCP client connectivity (stdio transport)
Step 17: Confirm CI/CD pipelines green on Node.js 26
| Phase | Timeline | Actions | Risk |
|---|---|---|---|
| Current Production | Apr 2026 β Oct 2027 | Node.js 26 LTS in production | π’ Low |
| Alpha 27 CI | Oct 2026 β Mar 2027 | Add 27.0.0-alpha.* to CI matrix (non-blocking) |
π’ Low |
| Current 27 Eval | Apr 2027 β Oct 2027 | Test on Node.js 27.x Current; fix compatibility issues | π‘ Medium |
| LTS 27 Migration | Oct 2027 | Upgrade production to Node.js 27 LTS | π‘ Medium |
| Node.js 26 Sunset | Apr 2029 | Node.js 26 reaches EOL; must be fully on 27+ | π’ Low (if planned) |
Per the Node.js project's guidance, library authors should integrate Alpha releases into CI as early as possible to report bugs before they affect users. As an npm-published MCP server, this project will:
continue-on-error: true) when Node.js 27 alpha opens in October 2026| Year | Node.js Version | Release Date | Phase | Action for this Project |
|---|---|---|---|---|
| 2026 | 25.x | Oct 2025 | β οΈ Current (EOL Apr 2026) | CURRENT β upgrade to 26 ASAP |
| 2026 | 26.x | β Apr 22, 2026 | Current β LTS (Oct 2026) | Upgrade within 2 days of release |
| 2026 | 27.x Alpha | Oct 2026 | Alpha | Add to CI matrix (non-blocking) |
| 2027 | 27.x | Apr 2027 | Current β LTS (Oct 2027) | Evaluate; new release model (every version = LTS) |
| 2027 | 28.x Alpha | Oct 2027 | Alpha | Add to CI matrix (non-blocking) |
| 2028 | 28.x | Apr 2028 | Current β LTS (Oct 2028) | Evaluate for migration from 27.x |
| 2029 | Node.js 26 EOL | Apr 2029 | β | Must be fully on 27+ before this date |
| 2029 | 29.x Alpha | Oct 2028 | Alpha | Add to CI matrix |
| 2030 | Node.js 27 EOL | Apr 2030 | β | Must be fully on 28+ before this date |
| 2031 | Node.js 28 EOL | Apr 2031 | β | Must be fully on 29+ before this date |
Note: Starting with Node.js 27 (released April 2027), the release schedule changes to one major release per year with every release becoming LTS. See Node.js Release Schedule Evolution for details.
| Tool | Purpose | Frequency |
|---|---|---|
| Dependabot | Dependency version updates | Daily |
| npm audit | Vulnerability scanning | Per CI/CD run |
| OpenSSF Scorecard | Project health monitoring | Weekly |
| GitHub Security Advisories | CVE notifications | Real-time |
| Activity | Frequency | Owner |
|---|---|---|
| Dependency audit | Quarterly | Development team |
| Node.js roadmap review | Semi-annual | Tech lead |
| MCP protocol evolution | Quarterly | Development team |
| EP API changes | Monthly | Development team |
| Phase | Version Range | Support Level |
|---|---|---|
| Active Development | Current major | Full support |
| Maintenance | Previous major | Security fixes only |
| Deprecated | Older versions | No support, deprecation notice |
| Archived | N/A | npm deprecation, GitHub archive |
npm deprecate with migration instructionsThe project reaches End-of-Life when any of the following occur:
| Trigger | Description | Impact |
|---|---|---|
| π MCP Protocol Obsolescence | MCP protocol replaced by successor | Architecture rewrite required |
| ποΈ EP API Discontinued | European Parliament data API shut down | Core functionality lost |
| π¦ Node.js Platform EOL | No supported Node.js LTS available | Runtime unavailable |
| π Unresolvable Security Issue | Critical vulnerability with no fix | Security risk unacceptable |
| π₯ Maintainer Unavailability | No active maintainers for > 12 months | No security updates |
Node.js 25 is an odd-numbered Current-only release (old model). It has no LTS phase and expires when Node.js 26 releases. Upgrade procedure:
IMMEDIATE Upgrade to Node.js 26 (upon April 2026 release):
Step 1: Update package.json engines: "node": ">=26.0.0"
Step 2: Update GitHub Actions workflows: node-version: "26"
Step 3: Update .devcontainer: node version 26
Step 4: Run: npm ci (rebuild native modules if any)
Step 5: Run: npm test (full test suite β 2600+ unit tests)
Step 6: Run: npm run lint (code quality check)
Step 7: Run: npm run build (TypeScript compilation)
Step 8: Update all documentation (README, DEVELOPER_GUIDE, this EOL Strategy)
Step 9: Publish new npm version
Step 10: Verify npm package installs correctly on Node.js 26
Step 11: Test MCP client connectivity (stdio transport)
Step 12: Monitor CI/CD for 24 hours before closing the upgrade PR
Starting with Node.js 27+, upgrades follow the new annual release cadence with a 6-month alpha β 6-month Current β 30-month LTS lifecycle:
Pre-Migration (Alpha Phase, OctβMar):
Step 1: Add alpha version to CI matrix as non-blocking job
Step 2: Monitor test failures and file upstream issues
Step 3: Track dependency compatibility reports
Migration (On LTS Promotion, October):
Step 4: Update package.json engines field to new LTS version
Step 5: Update GitHub Actions workflow (Node.js version matrix)
Step 6: Run: npm install (rebuild native modules if any)
Step 7: Run: npm test (full test suite β 2500+ unit tests)
Step 8: Run: npm run lint (code quality check)
Step 9: Run: npm run build (TypeScript compilation)
Step 10: Update documentation (README, DEVELOPER_GUIDE, End-of-Life-Strategy.md)
Step 11: Publish new npm version
Post-Migration Validation:
Step 12: Verify npm package installs correctly on new Node.js version
Step 13: Test MCP client connectivity (stdio transport)
Step 14: Monitor production for 1 week before removing old Node.js from CI
Step 1: Update typescript dependency
Step 2: Review tsconfig.json for new options
Step 3: Fix any new type errors
Step 4: Run full test suite
Step 5: Publish patch release
Step 1: Review MCP SDK changelog for breaking changes
Step 2: Update @modelcontextprotocol/sdk dependency
Step 3: Update tool/resource registrations if needed
Step 4: Run E2E tests with MCP client
Step 5: Update API documentation
Step 6: Publish new version
| Item | Action | Status |
|---|---|---|
| npm deprecation notice | npm deprecate with message |
On EOL |
| GitHub repository archive | Set repository to archived | On EOL |
| README deprecation banner | Add clear deprecation notice | On EOL |
| Documentation preservation | Docs remain accessible | Permanent |
| Release artifacts | GitHub releases preserved | Permanent |
| SBOM records | Final SBOM archived | On EOL |
| ISMS Policy | Relevance | Link |
|---|---|---|
| π Vulnerability Management | "Living on the Edge" philosophy | Vulnerability_Management.md |
| π Secure Development | Technology lifecycle requirements | Secure_Development_Policy.md |
| π Backup & Recovery | Archive and preservation | Backup_Recovery_Policy.md |
| π·οΈ Classification | Impact-driven lifecycle decisions | CLASSIFICATION.md |
| π Open Source Policy | OSS governance and lifecycle | Open_Source_Policy.md |
| Document | Description | Link |
|---|---|---|
| π‘οΈ Security Architecture | Current security controls | SECURITY_ARCHITECTURE.md |
| π― Threat Model | Risk assessment | THREAT_MODEL.md |
| π Business Continuity Plan | Recovery procedures | BCPPlan.md |
| π° Financial Security Plan | Cost planning | FinancialSecurityPlan.md |
| β‘ Performance Testing | Benchmarks & analysis | performance-testing.md |
| ποΈ Architecture | System design | ARCHITECTURE.md |
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2026-02-20 | CEO | Initial EOL strategy β technology stack analysis, lifecycle matrix, dependency monitoring, migration procedures |
| 2.0 | 2026-03-12 | CEO | Major update: Node.js new release schedule (one major/year, every release LTS, alpha channel); added transition roadmap, Gantt timeline, release model comparison; updated version strategy for alpha CI integration; aligned with nodejs/Release#1113 |
| 3.0 | 2026-03-18 | CEO | Node.js 25 migration: Updated current production runtime to Node.js 25.x (Current); added urgent Node.js 26 upgrade plan (β April 22, 2026 β 2-week target); expanded full Node.js roadmap projections 2026β2031; updated Technology Lifecycle Matrix with Node.js 25 EOL risk; added Node.js 25 β 26 transition checklist; updated Gantt chart with Node.js 25 EOL and Node.js 26 LTS timeline |
This EOL strategy is maintained as part of the Hack23 AB ISMS framework.
Licensed under Apache-2.0