Skip to content

bantamkit 0.35.9

Choose a tag to compare

@Ink01101011 Ink01101011 released this 15 Oct 07:29
· 67 commits to main since this release
4bab744

Bug-fix release. It fixes the 17 bugs deferred from 0.35.8's audit sweep, plus the rest of #118. Each fix lands in both runtimes, and a conformance case compares the two.

Security

  • The MCP SDK is now 1.31.0, which is past GHSA-6qxp-vccf-f47h. --update now reports found 0 vulnerabilities. (#143)

MCP protocol (Node now matches Python)

  • A request whose params fail the schema, including a bad _meta, gets -32602 Invalid request parameters. (#147)
  • A request sent before initialize is refused, except ping. (#178)
  • resources/read with an odd URI answers Unknown resource. This covers a multi-segment name, a percent-encoded name, NUL, .. and an absolute path. (#180)
  • Each message keeps its own side table. -32700 and -32600 answers carry id null. Big ids are kept exactly. The server exits quietly when stdout closes. (#146 #148 #181)

Install, hooks and CLI

  • Host JSON keeps literal UTF-8 and the file's own indent, including in a CR-only file. (#118)
  • Both update commands use an absolute interpreter. Python's --hook works without [mcp]. (#171 #173)
  • Stacked one-shot flags are refused. A missing assets root is counted. int() parsing matches across runtimes. (#139 #140 #174)

Packaging and the token ledger

  • The .d.ts files no longer need @types/node, and the asset loaders take a bare name. (#144 #145)
  • token_ledger prints one JSON document when degraded. A BOM is not parsed on either side, and symlinked directories are not followed. (#124 #150 #151)

Gates: conformance --all PASS 14689 cases, 0 failures; pytest 3471 passed; npm 1438 tests, 0 fail.

Install: npm i -g bantamkit-mcp@0.35.9 · pip install "bantamkit[mcp]==0.35.9"

Milestone: https://github.com/Ink01101011/bantamkit/milestone/3 · PRs #196 #197