Skip to content

v3.0.7

Choose a tag to compare

View all tags
@CodeAbra CodeAbra released this 21 Aug 22:12
· 13 commits to main since this release
v3.0.7
71bbb6f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • The bundled MCP wrapper moves fast-uri to 3.1.5, closing three host-confusion advisories (GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6) in its URI validation — the only advisory-flagged dependency that reaches the shipped wheel. The rest of the wrapper tree (hono, ip-address, @hono/node-server, and via npm overrides qs, body-parser, esbuild) is pinned to patched versions so npm audit reports zero; those are tree-shaken out of the shipped bundle and never reached users.

CI hardening

  • cargo deny check (advisories, bans, licenses) runs on every push and pull request.
  • A CodeQL workflow analyzes the Python and TypeScript sources.
  • .github/dependabot.yml schedules weekly dependency updates across cargo, pip, npm, and GitHub Actions.

No user-facing API changes. Full changelog: CHANGELOG.md

Assets 9
Loading