Repository navigation
bantamkit 0.35.9
Bug-fix release. It fixes the 17 bugs deferred from 0.35.8's audit sweep, plus the rest of #118. Each fix lands in both runtimes, and a conformance case compares the two.
Security
- The MCP SDK is now 1.31.0, which is past GHSA-6qxp-vccf-f47h.
--updatenow reportsfound 0 vulnerabilities. (#143)
MCP protocol (Node now matches Python)
- A request whose params fail the schema, including a bad
_meta, gets-32602 Invalid request parameters. (#147) - A request sent before
initializeis refused, exceptping. (#178) resources/readwith an odd URI answersUnknown resource. This covers a multi-segment name, a percent-encoded name, NUL,..and an absolute path. (#180)- Each message keeps its own side table.
-32700and-32600answers carry idnull. Big ids are kept exactly. The server exits quietly when stdout closes. (#146 #148 #181)
Install, hooks and CLI
- Host JSON keeps literal UTF-8 and the file's own indent, including in a CR-only file. (#118)
- Both update commands use an absolute interpreter. Python's
--hookworks without[mcp]. (#171 #173) - Stacked one-shot flags are refused. A missing assets root is counted.
int()parsing matches across runtimes. (#139 #140 #174)
Packaging and the token ledger
- The
.d.tsfiles no longer need@types/node, and the asset loaders take a bare name. (#144 #145) token_ledgerprints one JSON document when degraded. A BOM is not parsed on either side, and symlinked directories are not followed. (#124 #150 #151)
Gates: conformance --all PASS 14689 cases, 0 failures; pytest 3471 passed; npm 1438 tests, 0 fail.
Install: npm i -g bantamkit-mcp@0.35.9 · pip install "bantamkit[mcp]==0.35.9"
Milestone: https://github.com/Ink01101011/bantamkit/milestone/3 · PRs #196 #197