v2.2.1 ships stale bin/cli.mjs — PR #212 double-serialization fix not included in bundle (published 33 min before PR merge)

[sergisp9-rgb]

Summary

Same pattern as #204 for v2.1.0, now reproduced in v2.2.1.

bin/cli.mjs in the published v2.2.1 package does not include the deserializeParams / withStringFallback fix from PR #212.

Timeline evidence

Event	Timestamp (UTC)
v2.2.1 published to npm	2026-03-05 17:29:55
PR #212 merged	2026-03-05 18:02:08

The bundle was built and published 33 minutes before PR #212 was merged, so the fix never made it in.

Verification

# v2.2.1 installed via: npm install -g @notionhq/notion-mcp-server
npm view @notionhq/notion-mcp-server version   # 2.2.1

# Fix exists in TypeScript source:
grep -c "deserializeParams" node_modules/@notionhq/notion-mcp-server/src/openapi-mcp-server/mcp/proxy.ts
# 3

# But NOT in the bundle that actually runs:
grep -c "deserializeParams\|withStringFallback" node_modules/@notionhq/notion-mcp-server/bin/cli.mjs
# 0

wc -l node_modules/@notionhq/notion-mcp-server/bin/cli.mjs
# 502  (identical to pre-fix bundle)

Impact

The parent parameter in API-post-page (and other object params) is still double-serialized as a string, causing:

body.parent should be an object or `undefined`,
instead was "{\"database_id\": \"...\"}"

All users on v2.2.1 (the current latest) still hit this bug when calling API-post-page / API-patch-block-children / API-move-page with object parameters.

Workaround (until fixed release)

Call the Notion REST API directly, bypassing the MCP layer:

import urllib.request, json

headers = {
    "Authorization": f"Bearer {NOTION_TOKEN}",
    "Notion-Version": "2022-06-28",
    "Content-Type": "application/json",
}
body = {
    "parent": {"database_id": "34e6264a-1b3d-8163-987e-ddb05a0ef6ea"},
    "properties": { ... }
}
req = urllib.request.Request(
    "https://api.notion.com/v1/pages",
    data=json.dumps(body).encode(),
    headers=headers, method="POST"
)
with urllib.request.urlopen(req) as r:
    data = json.loads(r.read())

Suggested fix

Rebuild bin/cli.mjs from current source and publish as v2.2.2 (patch). Consider adding a CI gate that verifies bin/cli.mjs is up-to-date before publishing (as suggested in #204).

Related

• Parameter serialization bug: Object parameters received as strings in create-pages and move-pages tools #82 — original parent serialization bug (July 2025, still open)
• Fix double-serialization of object parameters in deserializeParams #196 — deserializeParams fix PR analysis
• v2.1.0 ships stale bin/cli.mjs — PR #180 deserializeParams fix not included in bundle #204 — same stale-bundle issue for v2.1.0
• PR fix: allow MCP clients that double-serialize parameters to work correctly #212 — the fix that was supposed to land in v2.2.1