@@ -83,22 +83,28 @@ npm audit --audit-level=high
 # Python: each server has its own lockfile. `uv` has no audit of its own in the
 # version pinned here, so the locked requirements go through pip-audit.
 # Exported to a file first: piped straight in, a failed `uv export` hands
-# pip-audit empty input, which it reports as clean. The block runs in a
-# subshell that exits non-zero if any server could not be exported, so an
-# unaudited server cannot pass as an audited one.
+# pip-audit empty input, which it reports as clean. And pip-audit exits
+# non-zero both when it finds something and when it could not run, so a
+# server counts as audited only when its output holds a verdict. The block
+# runs in a subshell that exits non-zero if any server was not audited.
 (
   unaudited=
   for s in fetch git time; do
     echo "== $s"
-    REQ=$(mktemp)
+    REQ=$(mktemp) OUT=$(mktemp)
     if (cd "src/$s" && uv export --frozen --no-emit-project --format requirements-txt) > "$REQ" \
         && [ -s "$REQ" ]; then
-      uvx pip-audit --require-hashes --disable-pip -r "$REQ"
+      uvx pip-audit --require-hashes --disable-pip -r "$REQ" > "$OUT" 2>&1
+      cat "$OUT"
+      grep -qE 'No known vulnerabilities found|Found [0-9]+ known vulnerabilit' "$OUT" || {
+        echo "AUDIT DID NOT RUN for $s: no verdict in its output" >&2
+        unaudited="$unaudited $s"
+      }
     else
       echo "EXPORT FAILED for $s: nothing was audited" >&2
       unaudited="$unaudited $s"
     fi
-    rm -f "$REQ"
+    rm -f "$REQ" "$OUT"
   done
   [ -z "$unaudited" ] || { echo "NOT AUDITED:$unaudited" >&2; exit 1; }
 ); echo "python audit complete: EXIT=$?"
@@ -146,7 +152,7 @@ releases nothing:
 # Refresh first, and read the REMOTE tree: the checkout may be a preparation
 # branch cut before another PR merged.
 git fetch origin main v2/main --tags
-git ls-tree --name-only origin/v2/main .changeset/ | grep '\.md$' | grep -v README.md   # the pending changesets
+git ls-tree -r --name-only origin/v2/main .changeset/ | grep '\.md$' | grep -vx '.changeset/README.md'   # the pending changesets
 # Since the latest published Release, asked of GitHub: this repo's tags do not
 # sort into release order (see 5a).
 PREV=$(gh release view --repo modelcontextprotocol/servers --json tagName --jq .tagName)
 
@@ -57,6 +57,16 @@ on:
   release:
     types: [published]
 
+# One release at a time, and never cancelled. Each publish leg reads the
+# registry's `latest`, chooses a dist-tag from it and publishes; two runs doing
+# that at once could each see the old `latest` and then publish out of order,
+# leaving the lower version tagged `latest`. Queuing the second run behind the
+# first makes its read see what the first published. Never cancelled, because
+# a run stopped between packages leaves a release half published.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 # Nothing in this workflow needs more than read access by default; the two
 # publish jobs add `id-token: write` for themselves.
 permissions:
 
@@ -162,7 +162,8 @@ than `GITHUB_TOKEN`. Today that is `release.yml`'s publish jobs and
   `uses: actions/checkout@<40-hex sha> # v6.1.0`. A tag can be moved, and a
   moved tag runs new code next to the credential with no change in this
   repository. The same holds for **a job whose artifact a credentialed job
-  downloads**, since what it builds is what gets published.
+  downloads**, since what it builds is what gets published, and for **a job
+  whose outputs a credentialed job reads**, since the reader acts on them.
   `verify:action-pins` enforces both. Other jobs keep moving major tags.
 - **A job that holds a publish credential does not install dependencies or
   build.** `release.yml` builds, tests and verifies each package in a job
 
@@ -36,7 +36,12 @@
 //      under provenance, so a moved tag in the build job publishes as surely
 //      as one in the publish job would. (The build was split out of the
 //      publish job to keep the OIDC token away from dependency installs; this
-//      keeps a moving tag out of what gets published.)
+//      keeps a moving tag out of what gets published.); or
+//   4. has outputs that a credentialed job reads (`needs.<job>.outputs.…`).
+//      The reader acts on them next to its credential. Here that is
+//      `release.yml`'s `detect-packages`: the publish jobs take from it the
+//      name and version an artifact must match before it is published, so a
+//      moved tag there could approve a tampered artifact.
 //
 // `GITHUB_TOKEN` alone does not count: every job holds one, so counting it
 // would turn this into "pin everything", which #4873 does not ask. That is why
@@ -199,10 +204,35 @@ export function credentialedJobs(yaml, file) {
     }
     return seen;
   };
+  // The jobs whose outputs a job reads: every `needs.<job>.outputs` anywhere
+  // in it. `needs.*.outputs` and a dynamic index name no job, so they count
+  // every job it needs.
+  const outputsReadBy = (job) => {
+    const read = new Set();
+    for (const text of stringsIn(job)) {
+      if (!text.includes(EXPRESSION_OPEN)) continue;
+      for (const m of text.matchAll(
+        /\bneeds\s*(?:\.\s*([\w-]+|\*)|\[\s*(?:'([^']*)'|"([^"]*)"|[^\]]*)\s*\])\s*(?:\.\s*outputs\b|\[\s*['"]outputs['"]\s*\])/g,
+      )) {
+        const named = m[1] ?? m[2] ?? m[3];
+        if (named === undefined || named === "*")
+          for (const n of needsOf(job)) read.add(n);
+        else read.add(named);
+      }
+    }
+    return read;
+  };
   for (let grew = true; grew; ) {
     grew = false;
     for (const [name, job] of jobs) {
-      if (!held.has(name) || !mayDownloadArtifact(job)) continue;
+      if (!held.has(name)) continue;
+      for (const source of outputsReadBy(job)) {
+        if (workflow.jobs[source] && !held.has(source)) {
+          held.add(source);
+          grew = true;
+        }
+      }
+      if (!mayDownloadArtifact(job)) continue;
       for (const producer of upstreamOf(name)) {
         if (!held.has(producer) && mayUploadArtifact(workflow.jobs[producer])) {
           held.add(producer);
@@ -284,10 +314,10 @@ export function main(root = repoRoot) {
         "\n\nA job holding `id-token`/`packages: write`, a non-default secret, or building an" +
         "\nartifact such a job consumes runs only immutable refs. Pin each as" +
         "\n  uses: owner/repo@<40-hex sha> # vX.Y.Z" +
-        "\nA local `./…` action or workflow is refused there as well: this guard does not" +
-        "\nread what it runs. Inline its steps, or extend the guard to follow it." +
-        "\nresolving the SHA and the exact release from the same tag lookup. The comment" +
-        "\nnames the release the SHA came from, for a reviewer and for the dependency sweep.",
+        "\nResolve the SHA and the exact release from the same tag lookup. The comment" +
+        "\nnames the release the SHA came from, for a reviewer and for the dependency sweep." +
+        "\n\nA local `./…` action or workflow is refused in such a job as well: this guard" +
+        "\ndoes not read what it runs. Inline its steps, or extend the guard to follow it.",
     );
     return 1;
   }
 
@@ -281,6 +281,75 @@ test("a credentialed reusable-workflow call counts as an artifact downloader", (
   ]);
 });
 
+test("a job whose outputs a credentialed job reads is credentialed", () => {
+  const yaml = wf(
+    "jobs:",
+    "  detect:",
+    "    steps:",
+    "      - uses: actions/checkout@v7",
+    "  lint:",
+    "    steps:",
+    "      - uses: actions/checkout@v7",
+    "  publish:",
+    "    needs: [detect, lint]",
+    "    permissions:",
+    "      id-token: write",
+    "    steps:",
+    "      - env:",
+    "          EXPECTED: ${{ fromJson(needs.detect.outputs.expected)[matrix.package].name }}",
+    "        run: publish",
+  );
+  // `lint` is needed but nothing of its is read, so it gates the job without
+  // feeding it.
+  assert.deepEqual([...credentialedJobs(yaml)].sort(), ["detect", "publish"]);
+  assert.deepEqual(unpinnedRefs(yaml), [
+    { job: "detect", uses: "actions/checkout@v7" },
+  ]);
+});
+
+test("outputs read in a job's if, matrix or bracket form count too", () => {
+  const yaml = wf(
+    "jobs:",
+    "  a:",
+    "    runs-on: x",
+    "  b:",
+    "    runs-on: x",
+    "  c:",
+    "    runs-on: x",
+    "  publish:",
+    "    needs: [a, b, c]",
+    "    if: ${{ needs.a.outputs.go == 'true' }}",
+    "    permissions:",
+    "      id-token: write",
+    "    strategy:",
+    "      matrix:",
+    "        package: ${{ fromJson(needs['b'].outputs.packages) }}",
+    "  unrelated:",
+    "    needs: [c]",
+    "    steps:",
+    "      - run: echo ${{ needs.c.outputs.x }}",
+  );
+  // `c` is read only by a job that holds no credential.
+  assert.deepEqual([...credentialedJobs(yaml)].sort(), ["a", "b", "publish"]);
+});
+
+test("needs.*.outputs counts every job the reader needs", () => {
+  const yaml = wf(
+    "jobs:",
+    "  a:",
+    "    runs-on: x",
+    "  b:",
+    "    runs-on: x",
+    "  publish:",
+    "    needs: [a, b]",
+    "    permissions:",
+    "      id-token: write",
+    "    steps:",
+    "      - run: echo ${{ join(needs.*.outputs.v) }}",
+  );
+  assert.deepEqual([...credentialedJobs(yaml)].sort(), ["a", "b", "publish"]);
+});
+
 test("an upload is not credentialed when the consumer downloads nothing", () => {
   const yaml = wf(
     "jobs:",