Skip to content

v2.0.40 - Runtime reliability and security hardening

Choose a tag to compare

View all tags
@mickdarling mickdarling released this 05 Aug 19:19
v2.0.40
8695a0a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

DollhouseMCP 2.0.40

This patch release focuses on runtime reliability, path containment, and supply-chain security.

Highlights

  • Recover stale agent execution policies through a narrow durable-state-verified path while preserving active restart and permission protections. (#2427, #2428, #2441)
  • Preserve append-only memory writes when historical entries trigger newer content-scanner rules, while retaining structural YAML and control-field validation. (#2440, #2442)
  • Keep collection caches under Dollhouse home by default and prevent cache files from leaking into the process working directory. (#2426, #2443)
  • Restore the SonarCloud security rating and harden CI, containers, setup installs, external tooling, and download validation. (#2446, #2447)
  • Update the existing exact giget -> tar override to tar@7.5.22, removing the critical runtime archive-processing advisory without changing any other dependency. (#2449, #2450)

Distribution

The release workflows publish:

  • npm package @dollhousemcp/mcp-server@2.0.40 under the latest tag with provenance
  • MCP Registry metadata
  • the DollhouseMCP .mcpb desktop bundle
  • GitHub Packages

See CHANGELOG.md for the complete release history.

Assets 4
Loading