v0.3.3

Everything merged since 0.3.1 (0.3.2 was tagged but never published, so its changes ship here too).

Connection-failure handling (#61, #76)

• Failures are no longer silent. ERROR-level logs always reach stderr with the underlying code and an actionable hint (TLS trust, DNS, refused, timeout).
• No more faked success. A failed initialize returns a degraded result advertising only experimental.connectionFailed, so SDK clients complete the handshake and can detect the degraded state; later calls return a structured JSON-RPC error with data (reason, code, detail, hint).
• Bounded handshake — no ~60s hang. Requests use AbortSignal.timeout: WP_API_INIT_TIMEOUT_MS (default 25s) for initialize, WP_API_TIMEOUT_MS (default 120s) for tool calls. Timeouts skip the simple-transport fallback so a stalled upstream fails once, not twice.
• Faithful error forwarding. WordPress JSON-RPC error codes pass through unchanged (e.g. -32602 stays -32602); HTTP-status errors map to sensible MCP codes (401 → -32010). Previously everything flattened to -32603.
• TLS docs. Recommends NODE_EXTRA_CA_CERTS / NODE_USE_SYSTEM_CA for locally-trusted CAs (mkcert/DDEV/corporate/VPN); NODE_TLS_REJECT_UNAUTHORIZED=0 only as an insecure last resort.

Other fixes

• Logging: preserve the Error message and stack in log output — errors previously serialized to {}, hiding the real cause (#75).
• SOCKS proxy: synthesized SOCKS proxy URLs now use socks5h:// (remote DNS resolution), fixing IPv6 SOCKS proxy handling (#63).

Dependencies

• Bump @modelcontextprotocol/sdk 1.10.1 → 1.26.0 (#72).
• Dependabot security & maintenance updates: rollup → 4.61.0 (#71), js-yaml → 3.14.2 (#73), ip-address → 10.2.0 (#69), tmp → 0.2.6 (#66), picomatch → 2.3.2 (#70), path-to-regexp/express, minimatch, playwright (dev), and grouped updates (#65, #68, #74).

Maintenance

• Realign MCP_WORDPRESS_REMOTE_VERSION (proxy's reported serverInfo.version) with the package version; it had drifted to 0.3.0 (#77).

New environment variables

• WP_API_INIT_TIMEOUT_MS (default 25000)
• WP_API_TIMEOUT_MS (default 120000)
• LOG_TO_STDERR (default false; ERROR-level logs always go to stderr)

Validation

Unit/integration tests, a local stub harness, a real WordPress.com endpoint (OAuth + SOCKS), MCP Inspector, and clean-environment release probes.

Contributors

• @galatanovidiu — connection-failure handling (#76), logging fix (#75), release (#77)
• @luismulinari — SOCKS5h IPv6 fix (#63)

Dependency updates via Dependabot.

Thanks to @adamslowe for the detailed report in #61, and @NigelAmyes for additional reproduction details.

Full changelog: v0.3.1...v0.3.3