Skip to content

Release v0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Jul 23:16
v0.5.0
682fea8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Type-check the test suite in local and hosted CI, align Node type definitions with the Node 24 runtime, and pin the expected npm version through packageManager.
  • Add stateless GET /mcp redelivery from Last-Event-ID, including detached completion when a client disconnects before an in-flight POST result is ready.
  • Add rotate_api_key and five Secret Reference CRUD tools, plus documented-response fixtures, contracts, and a safe disposable live-fixture recorder.

Changed

  • Upgrade to node-redis 6.1 and TypeScript 7.0 while preserving the Redis event store's RESP2, timeout, and keepalive behavior.
  • Keep the stateless event store opt-in (off by default); memory enables single-instance replay and redis enables cross-instance replay.
  • Require integer current_page and page_size values across all paginated tools.

Security

  • Pin the MCP Registry publisher to v1.7.9 and verify its official SHA-256 checksum before executing it in the OIDC-enabled release job.
  • Harden unauthenticated loopback Host validation for IPv4 and bracketed IPv6, including rejection of malformed IPv6 authority suffixes.
  • Use opaque replay cursors and per-stream memory/Redis leases so cursors cannot be guessed and concurrent replay connections cannot duplicate delivery.

Fixed

  • Run release CI and registry publishing against the requested tag during manual/automatic dispatches instead of implicitly checking out main.
  • Normalize trailing slashes in PORTKEY_BASE_URL, strictly validate integer environment settings, and apply the configured graceful-shutdown timeout consistently.
  • Accept post-initialization MCP requests without a protocol header by using negotiated/backwards-compatible behavior, while continuing to reject unsupported or mismatched versions.
  • Return controlled JSON for malformed request bodies instead of Express's default HTML error response.
  • Restore the missing 0.4.1 changelog boundary and clearly label the June audit and completed roadmap as historical snapshots.

What's Changed

  • 🔧 config(coderabbit): tailor agent rules for MCP tool surface by @scttbnsn in #17
  • 🔧 config(greptile): on-call reviews only, skip automatic by @scttbnsn in #21
  • Release v0.5.0: control-plane tools, resumable MCP, Redis 6 and TypeScript 7 by @scttbnsn in #22

Full Changelog: v0.4.2...v0.5.0

Contributors

scttbnsn
Assets 2
Loading