v1.0.0-rc16

Fixed

• evm_get_logs over-wide block ranges now return an actionable message
  ("block range too wide … narrow the range and retry") instead of the opaque
  upstream operation failed. The upstream node's range-cap rejection
  (observed as maximum [from, to] blocks distance: 10000) is recognized at
  the RPC boundary via the same curated-allowlist pattern as precompile
  reverts; the node's raw error text is never echoed. (dmome21 smoke
  2026-07-28, Finding 3)
• evm_get_transaction not-found responses no longer double the message
  (transaction not found: transaction not found): the handler re-wrapped the
  client's own sentinel with the same prefix, which also mislabeled genuine
  upstream failures as not-found. The evm_get_logs handler had the same
  latent re-prefix and was fixed alongside. (Finding 4)
• Empty-JSON-object metadata ({}) rejection no longer leaks its
  classifier (the trailing : missing required parameter): it now surfaces
  a dedicated input-class sentinel whose text is exactly the curated message —
  the value is present but invalid, not missing. (Finding 4)

Changed

• Bumped actions/checkout v6.0.3 → v7.0.1 across all workflows,
  superseding Dependabot PR #60 (whose SHA update left the stale # v6
  comments on the pins). v7's breaking change only affects
  pull_request_target/workflow_run triggers, which no workflow here uses.
  CI-only, no image change.
• Bumped the OpenTelemetry module family v1.43.0 → v1.44.0 (Prometheus
  exporter v0.65.0 → v0.66.0) and modelcontextprotocol/go-sdk v1.6.0 →
  v1.6.1 in one batch, superseding Dependabot PRs #4–#13. Transitive lifts:
  grpc-ecosystem/grpc-gateway/v2 v2.28.0 → v2.29.0, genproto pins, and the
  new go.opentelemetry.io/otel/metric/x v0.66.0 module (all Apache-2.0 /
  BSD-3). Routine version-update hygiene, no security advisories involved;
  vendor tree regenerated.
• Grouped future Dependabot OpenTelemetry updates into a single PR
  (.github/dependabot.yml groups: stanza) so the
  otel module family no longer arrives as 8+ interlocking PRs that conflict on
  go.sum/vendor/.
• Dependabot bumps merged since rc15 (recorded here for image
  provenance): pressly/goose/v3 3.27.1 → 3.27.3 (#62),
  prometheus/client_golang 1.23.2 → 1.24.0 (#61), and the
  distroless/static-debian12 base-image digest refresh (#58) — all three
  change the compiled image; docker/login-action 4.2.0 → 4.5.0 (#59) is
  CI-only.

---

Verifying signatures

Each binary is shipped with a Cosign keyless signature (via Sigstore OIDC) and a SHA-256 checksum.

# Verify checksum
shasum -a 256 -c nvnm-mcp-server-v1.0.0-rc16-<os>-<arch>.sha256

# Verify Cosign signature
cosign verify-blob \
  --certificate nvnm-mcp-server-v1.0.0-rc16-<os>-<arch>.cert.pem \
  --signature nvnm-mcp-server-v1.0.0-rc16-<os>-<arch>.sig \
  --certificate-identity-regexp 'https://github.com/NVNM-Chain/nvnm-mcp-server/.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  nvnm-mcp-server-v1.0.0-rc16-<os>-<arch>