Skip to content

v1.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 06:04
v1.3.0
89cb645
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • 安全：构建改用 Go 1.27.0（原 1.26.5）。govulncheck 实证 1.26.5 构建出的二进制有五条可达的标准库公告，全部在 1.26.6 修复并带进 1.27.0：GO-2026-6089（net/http 对明文 HTTP/2 探测没有应用 ReadHeaderTimeout，客户端可以把连接按住超过头部超时，本服务的 ListenAndServe 可达）、GO-2026-6218（net/url 路径解析的平方复杂度，经 RDAP 客户端可达）、GO-2026-6090（crypto/tls 接受无上限的握手后消息，经 RDAP 连接、WHOIS 读取与 Redis TLS 可达）、GO-2026-5026（内联进 net/http 的那份 golang.org/x/net/idna 接受纯 ASCII 的 Punycode 标签；独立的 x/net 模块早在 0.55.0 就修了，本服务用的版本远在其后）、GO-2026-5972（encoding/asn1 递归深度）。1.27.0 下 govulncheck 报告无可达公告
  • 新增：/mcp 的工具调用现在计入 whois_http_requests_total 与 whois_http_request_duration_seconds，资源类型为 mcp 与 mcp_batch，状态码取底层查询实际产生的那个。此前该端点在请求指标里完全不可见——只有按密钥统计的计数器看得到它，而那还得开了鉴权才存在
  • 新增：docs/metrics.md 逐个说明导出的每个指标、它的标签与取值，并给出建议告警（IANA 引导数据陈旧、缓存后端错误、5xx 比例、并发拒绝、注册局变慢）和几条常用查询
  • 新增：两个 MCP 工具都标注为只读，会在可能产生副作用的工具前插入确认提示的客户端因此可以直接调用它们
  • 新增：tools/list 与 server/discover 带上一小时的 ttlMs 缓存提示（MCP 协议 2026-07-28 引入）——工具列表对每个调用方都一样，只在服务升级时才变。开放实例的缓存作用域是 public，配置了 auth.keys 后变为 private，共享中间层因此不会把鉴权实例的工具列表发给没带凭证的调用方
  • 修复：CORS 预检现在放行 Mcp-Method 与 Mcp-Name 请求头，MCP 协议 2026-07-28 要求每个 /mcp 请求都带上它们。浏览器里的 MCP 客户端此前在预检就被挡下、根本到不了端点；不受 CORS 约束的客户端不受影响
  • 变更：内置 IANA 服务器列表刷新（2026 年 8 月）——.jo 新增 WHOIS 服务器；.uk 与 .zara 移出 WHOIS 表，因为 IANA 已不再为它们登记服务器。这两个 TLD 的普通查询不受影响，本来走的就是服务优先选用的 RDAP，只有 WHOIS 专用的 ?raw=1 改为回 404。.jo 方向相反：它没有 RDAP 服务器，于是从「无可用服务器」变成走 WHOIS 查询
  • 依赖：modelcontextprotocol/go-sdk 1.7.0、redis/go-redis 9.22.0、golang.org/x/net 0.58.0、prometheus/client_golang 1.24.1
  • Security: builds now use Go 1.27.0, up from 1.26.5. govulncheck finds five standard-library advisories reachable from a 1.26.5 build of this binary, all fixed in 1.26.6 and carried into 1.27.0: GO-2026-6089 (net/http did not apply ReadHeaderTimeout to the unencrypted HTTP/2 check, letting a client hold a connection past the header deadline — reached from this service's ListenAndServe), GO-2026-6218 (quadratic net/url path resolution, reached through the RDAP client), GO-2026-6090 (crypto/tls accepted unbounded post-handshake messages, reached from RDAP dials, WHOIS reads and Redis TLS), GO-2026-5026 (the copy of golang.org/x/net/idna vendored into net/http accepted ASCII-only Punycode labels; the standalone module was patched back in x/net 0.55.0, well before the version used here) and GO-2026-5972 (encoding/asn1 recursion depth). Under 1.27.0 govulncheck reports nothing reachable
  • Added: /mcp tool calls are recorded in whois_http_requests_total and whois_http_request_duration_seconds under the resource types mcp and mcp_batch, with the status the underlying query actually produced. The endpoint was previously invisible in the request metrics — only the per-key counter saw it, and only on instances with authentication enabled
  • Added: docs/metrics.md documents every exported metric, its labels and their values, with suggested alerts (bootstrap staleness, cache backend errors, 5xx rate, concurrency rejections, slow registries) and a few ready-made queries
  • Added: both MCP tools are annotated read-only, so clients that put a confirmation prompt in front of tools that can act may call them directly
  • Added: tools/list and server/discover carry a one-hour ttlMs cache hint, introduced in MCP protocol revision 2026-07-28 — the tool list is identical for every caller and only changes when the service is upgraded. The scope is public on an open instance and private once auth.keys is set, so no shared intermediary serves an authenticated instance's tool list to callers that never presented a key
  • Fixed: CORS preflight allows the Mcp-Method and Mcp-Name request headers, which MCP protocol revision 2026-07-28 requires on every /mcp request. Browser-based MCP clients were turned away at preflight and never reached the endpoint; clients not subject to CORS were unaffected
  • Changed: the compiled-in IANA server lists were refreshed (August 2026) — .jo gained a WHOIS server, and .uk and .zara left the WHOIS map because IANA no longer lists one for either. Normal queries for those two are unaffected, since they already went through RDAP, which the service prefers; only ?raw=1, which is WHOIS-only, now answers 404. .jo moves the other way: it has no RDAP server, so it goes from "no server known" to a WHOIS lookup
  • Dependencies: modelcontextprotocol/go-sdk 1.7.0, redis/go-redis 9.22.0, golang.org/x/net 0.58.0, prometheus/client_golang 1.24.1
Assets 22
Loading