Release v2.6.8 - CI + audit hardening · TunaSync-Studio/UnityMCP-VCC

Unity plugin + npm server release. Supersedes 2.6.7 on npm (2.6.7 shipped to GitHub/VPM only; everything in it is included here).

Added

CI: typecheck + full vitest suite (real-TCP mock plugin) + bundle build + metadata smoke on every push/PR, Ubuntu + Windows.

Fixed (external-audit follow-ups)

Server robustness: length-capped log regex (ReDoS), vpm argument-injection guard, atomic arm consumption, editor_path must be a Unity binary, TCP dial timeout, fail-fast on dead-socket sends, atomic VCC settings.json update, vrc-get discovery no longer accepts unspawnable .cmd/.bat shims.
Plugin robustness: 16-connection cap, ndmf outputDir confined to Assets/, malformed requests answer INVALID_PARAMS instead of killing the session, oversized responses answer an error instead of a silent disconnect, import-callback cleanup, HTTP health no longer discloses the project path, csc diagnostics forced to English (mojibake fix on Japanese Windows).
v2.6.7 (included): token-file permission hardening, in-editor arm gate, POSIX eval probe, safer quit/launch, pidAlive unification, maxBuffer classification, doc corrections.

Navigation Menu