Repin to conformance main@b18aa918 (merge of #371)

conformance#371 has merged. Switch the pkg.pr.new pin from the PR-branch
commit (ed314a73) to the merge commit on main (b18aa918) — same tarball
bytes (SHA256 unchanged), but durable against PR-branch deletion. No
published @modelcontextprotocol/conformance release includes #371 yet
(latest is 0.2.0-alpha.7, cut before the merge), so the pkg.pr.new +
SHA256 verify machinery stays for now.

Author: maxisbey

.github/workflows/conformance.yml

@@ -19,15 +19,16 @@ env:
   # Bump deliberately and reconcile both
   # .github/actions/conformance/expected-failures*.yml files in the same change.
   #
-  # Temporarily pinned to the pkg.pr.new preview build of conformance#371, which
-  # fixes the http-custom-headers fixture's spec-forbidden `number`-typed
-  # x-mcp-header annotations. Pinned by commit SHA (not PR number) so a new push
-  # to #371 cannot silently change the tarball; CONFORMANCE_PKG_SHA256 then pins
-  # the bytes and the fetch-and-verify step below downloads, checks the digest,
-  # and repoints CONFORMANCE_PKG at the verified local copy. Repin to the
-  # published release that includes #371 once it ships, then drop
+  # Temporarily pinned to the pkg.pr.new build of conformance main@b18aa918
+  # (the merge of #371, which fixes the http-custom-headers fixture's
+  # spec-forbidden `number`-typed x-mcp-header annotations) — no published
+  # release includes it yet. Pinned by commit SHA so the tarball cannot move
+  # under us; CONFORMANCE_PKG_SHA256 pins the bytes and the fetch-and-verify
+  # step below downloads, checks the digest, and repoints CONFORMANCE_PKG at the
+  # verified local copy. Repin to the next published @modelcontextprotocol/
+  # conformance release (>0.2.0-alpha.7) once it ships, then drop
   # CONFORMANCE_PKG_SHA256 and the fetch-and-verify steps.
-  CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@ed314a73"
+  CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@b18aa918"
   CONFORMANCE_PKG_SHA256: "e9f6bc25085b4692e988cbdbd024a4203d54a52a6aaa065376cf8ecaa09bb680"
 
 jobs: