Skip to content

v2.0.37 - NVM config self-heal and path security hardening

Choose a tag to compare

View all tags
@mickdarling mickdarling released this 04 Jul 17:05
v2.0.37
1f2a637
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • NVM config self-heal (#2338, #2339) — MCP client configs (Claude Desktop, Cursor, Windsurf, LM Studio, Gemini CLI, VS Code, Cline) left pointing at a dead NVM launcher wrapper are repaired automatically on server startup: bare npx is restored when NVM is absent, or the real launcher is regenerated when NVM is present (preserving the #1902 protection). A guardrail prevents temp-directory wrapper paths from ever being written into a client config, and the test suite is fully isolated from real client configs.
  • Path security hardening (#2334) — reject symlink-based containment escapes from allowed directories; preserve element metadata and base-path handling through edit operations. (Remaining missing-base ancestor case tracked in #2342.)
  • Validation tightening (#2334) — content validator input-length checks; explicit ensemble element updates.

Full Changelog: v2.0.36...v2.0.37

Assets 4
Loading