lisa v0.9.5

📦 Published to npm as @lisa-mcp/server@0.9.5.

npx @lisa-mcp/server            # run locally
npm install @lisa-mcp/server    # or deploy to BTP from npm (templates/mta)
docker pull ghcr.io/clementringot/lisa-mcp:0.9.5   # self-hosted container

See the server CHANGELOG for details.

What's Changed

• chore(dev-deps): bump vitest from 4.1.9 to 5.0.1 by @dependabot[bot] in #74
• chore(deps): bump dotenv from 17.4.2 to 18.0.1 by @dependabot[bot] in #75
• chore(release): version packages by @lisa-release-bot[bot] in #76

Full Changelog: v0.9.4...v0.9.5

lisa v0.9.4

📦 Published to npm as @lisa-mcp/server@0.9.4.

npx @lisa-mcp/server            # run locally
npm install @lisa-mcp/server    # or deploy to BTP from npm (templates/mta)
docker pull ghcr.io/clementringot/lisa-mcp:0.9.4   # self-hosted container

See the server CHANGELOG for details.

What's Changed

• chore(ci): drop the retired CHANGESETS_PAT and NPM_TOKEN fallbacks by @ClementRingot in #59
• ci(changesets): require a changeset for dependency bumps that ship by @ClementRingot in #68
• chore(dev-deps): Bump @changesets/cli from 2.31.0 to 3.0.0 by @dependabot[bot] in #63
• chore(ci): Bump changesets/action from 1 to 2 in the github-actions group across 1 directory by @dependabot[bot] in #60
• chore(dev-deps): Bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in #65
• chore(deps): Bump the arc-mcp group across 1 directory with 2 updates by @dependabot[bot] in #61
• chore(deps): Bump express-rate-limit from 7.5.1 to 8.6.2 by @dependabot[bot] in #64
• chore(dev-deps): bump the npm-minor-patch group across 1 directory with 5 updates by @dependabot[bot] in #72
• fix(server): report the real version; stop Node majors from Dependabot by @ClementRingot in #73
• chore(release): version packages by @lisa-release-bot[bot] in #71

New Contributors

• @lisa-release-bot[bot] made their first contribution in #71

Full Changelog: v0.9.3...v0.9.4

lisa v0.9.3

📦 Published to npm as @lisa-mcp/server@0.9.3.

npx @lisa-mcp/server            # run locally
npm install @lisa-mcp/server    # or deploy to BTP from npm (templates/mta)
docker pull ghcr.io/clementringot/lisa-mcp:0.9.3   # self-hosted container

See the server CHANGELOG for details.

What's Changed

• docs(readme): license badge reads npm instead of GitHub detection by @ClementRingot in #46
• docs(readme): add ghcr.io and MCP-server badges by @ClementRingot in #47
• docs: direct-API kit — agent skill, BTP-destination guide, OpenAPI spec (Joule Studio ready) by @ClementRingot in #48
• security(skills): scope the ABAP-API skill to BTP destinations — no credential handling by @ClementRingot in #49
• docs: dedicated BTP-destination doc + destination-agnostic API skill + direct-API README callout by @ClementRingot in #50
• chore(ci): Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #52
• chore(deps): Bump the arc-mcp group across 1 directory with 2 updates by @dependabot[bot] in #53
• chore(deps): Bump dotenv from 16.6.1 to 17.4.2 by @dependabot[bot] in #27
• chore(dev-deps): Bump @types/node from 22.19.20 to 26.1.0 by @dependabot[bot] in #24
• build(deps-dev): TypeScript 5.7 → 6.0.3 (+ fix a latent missing @types/node) by @ClementRingot in #54
• build(deps-dev): Biome 1.9.4 → 2.5.2 with the config migration by @ClementRingot in #55
• fix(deps): patch all 9 npm audit vulnerabilities (7 high, 2 moderate) by @ClementRingot in #56
• chore: changeset to release the security patches (0.9.3) by @ClementRingot in #57
• chore(release): version packages by @ClementRingot in #58

Full Changelog: v0.9.2...v0.9.3

lisa v0.9.2

📦 Published to npm as @lisa-mcp/server@0.9.2.

npx @lisa-mcp/server            # run locally
npm install @lisa-mcp/server    # or deploy to BTP from npm (templates/mta)
docker pull ghcr.io/clementringot/lisa-mcp:0.9.2   # self-hosted container

See the server CHANGELOG for details.

What's Changed

• Scope rename @lisa/core → @lisa-mcp/core + automated GitHub releases by @ClementRingot in #33
• feat(server): publish the standalone MCP server to npm as @lisa-mcp/server by @ClementRingot in #34
• chore(release): version packages — @lisa-mcp/server 0.9.0, arc1-extension 0.3.1 by @ClementRingot in #35
• ci(release): fully automate the release train with changesets/action by @ClementRingot in #36
• ci(release): npm trusted publishing (OIDC), GitHub App auth, titled product releases by @ClementRingot in #37
• chore: changesets for the pipeline-validation patch release (0.9.1 / 0.3.2) by @ClementRingot in #38
• chore(release): version packages by @ClementRingot in #39
• docs(readme): state the server's two consumption modes (npm or clone) in the intro by @ClementRingot in #40
• docs(readme): add CI and release-pipeline status badges by @ClementRingot in #41
• docs(license): pristine MIT LICENSE + NOTICE so GitHub can identify the license by @ClementRingot in #42
• feat(docker): fix baked-in env defaults, document self-hosting, publish to ghcr.io by @ClementRingot in #43
• chore: changeset (server patch) — ship the fixed Docker image via v0.9.2 by @ClementRingot in #44
• chore(release): version packages by @ClementRingot in #45

Full Changelog: v0.8.5...v0.9.2

lisa v0.9.1

📦 Published to npm as @lisa-mcp/server@0.9.1.

npx @lisa-mcp/server            # run locally
npm install @lisa-mcp/server    # or deploy to BTP from npm (templates/mta)

See the server CHANGELOG for details.

What's Changed

• Scope rename @lisa/core → @lisa-mcp/core + automated GitHub releases by @ClementRingot in #33
• feat(server): publish the standalone MCP server to npm as @lisa-mcp/server by @ClementRingot in #34
• chore(release): version packages — @lisa-mcp/server 0.9.0, arc1-extension 0.3.1 by @ClementRingot in #35
• ci(release): fully automate the release train with changesets/action by @ClementRingot in #36
• ci(release): npm trusted publishing (OIDC), GitHub App auth, titled product releases by @ClementRingot in #37
• chore: changesets for the pipeline-validation patch release (0.9.1 / 0.3.2) by @ClementRingot in #38
• chore(release): version packages by @ClementRingot in #39

Full Changelog: v0.8.5...v0.9.1

lisa-arc1-extension v0.3.2

📦 Published to npm as @lisa-mcp/arc1-extension@0.3.2.

npm install @lisa-mcp/arc1-extension@0.3.2

See the extension CHANGELOG for details.

v0.9.0

📦 Published to npm as @lisa-mcp/server@0.9.0.

npx @lisa-mcp/server            # run locally
npm install @lisa-mcp/server    # or deploy to BTP from npm (templates/mta)

See CHANGELOG.md for details.

What's Changed

• Scope rename @lisa/core → @lisa-mcp/core + automated GitHub releases by @ClementRingot in #33
• feat(server): publish the standalone MCP server to npm as @lisa-mcp/server by @ClementRingot in #34
• chore(release): version packages — @lisa-mcp/server 0.9.0, arc1-extension 0.3.1 by @ClementRingot in #35
• ci(release): fully automate the release train with changesets/action by @ClementRingot in #36

Full Changelog: v0.8.5...v0.9.0

v0.8.5

Changed

• OIDC audience validation is now mandatory. When OIDC_ISSUER is set, OIDC_AUDIENCE must also be set or the server refuses to start (it previously warned and accepted any audience). Without an audience check the verifier accepts any token signed by the issuer — including one minted for a different app on a shared issuer (e.g. another Entra application in the same tenant), a token-confusion / confused-deputy risk (RFC 9700). The prior permissive behavior is still reachable, but only via the new explicit OIDC_ALLOW_ANY_AUDIENCE=true opt-out (logged loudly at every start). Action: OIDC deployments without OIDC_AUDIENCE must add it (or the opt-out) before upgrading.

Security

• Bump form-data 4.0.5 → 4.0.6 to patch a HIGH-severity CRLF injection advisory (GHSA-hmw2-7cc7-3qxx), pulled in transitively via arc-1 → @sap-cloud-sdk/connectivity → axios. npm audit now reports 0 vulnerabilities.

lisa-arc1-extension v0.3.1

📦 Published to npm as @lisa-mcp/arc1-extension@0.3.1.

npm install @lisa-mcp/arc1-extension@0.3.1

See CHANGELOG.md for details.

lisa-arc1-extension v0.3.0

📦 Published to npm as @lisa-mcp/arc1-extension@0.3.0.

npm install @lisa-mcp/arc1-extension@0.3.0

See CHANGELOG.md for details.