Skip to content

v2.0.2

Latest
Latest

Choose a tag to compare

View all tags
@MudassarTariq MudassarTariq released this 27 Oct 17:43
v2.0.2
7cabc50
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security update for the IPGeolocation.io MCP server.

  • Update Zod, body-parser, fast-uri, ip-address and qs dependency resolutions.
  • Use the patched Node.js 24.22.1 container base and check native Linux amd64 and arm64 images before publication.
  • Preserve all 17 tools, existing client configuration and cached-result behavior. No API or configuration migration is required.

Validation: 145 regression tests pass on Node.js 22.23.4 and 24.22.1. A fresh package installation preserves the tool definitions, rejects invalid input and passes real HTTPS public-IP and authentication-error checks. npm dependency audits report zero vulnerabilities.

After updating, restart the MCP server or client. Bundle installations also require a patched Node.js host runtime. Container installations must pull the new image and recreate their containers; publishing a release does not update running installations.

The source Dockerfile retains one unfixed upstream BusyBox medium advisory (CVE-2025-60876); its affected wget code is not used by this server. The separately published minimal container removes BusyBox and the shell. No high or critical container findings are accepted.

Assets 7
Loading