Security: require mcp-atlassian ≥ 0.22.1
Bumps the upstream pin floor to require mcp-atlassian 0.22.1, which carries two security fixes. No wrapper behavior changes — a dependency-floor bump so every install picks up the upstream fixes.
Upstream security fixes (mcp-atlassian 0.22.1)
- Jira JQL injection — caller-supplied filter values could inject JQL operators to escape the configured project allowlist. Values are now quoted as literals and generated project clauses are explicitly grouped.
- SSRF — caller-controlled destinations stay on the direct DNS-pinned path when deployment proxies are configured (proxy-side DNS can't bypass the rebinding defense); relative/scheme-relative redirects are resolved against the response URL before SSRF validation.
Compatibility
Signature-compatible — no monkey-patch changes needed. Verified against 0.22.1: assert_upstream_compatibility() passes (all four patched signatures bind) and the server module imports cleanly.
Full Changelog: v1.2.0...v1.2.1