v0.6.0 - Audit backlog + Connector Directory readiness

Wraps the remaining audit backlog and prepares the repo for Anthropic Claude Connector Directory submission. No breaking changes.

Audit backlog closed

• DevOps #4 — Structured JSON logging in HTTP mode (stdlib only, no new runtime dep). New LOG_FORMAT env override; defaults to json for streamable-http, text for stdio.
• Security M2 — Module-level asyncio.Semaphore(12) on the preview thumbnail fetcher. Caps concurrent CDN fan-out across all MCP sessions on the process.
• DevOps #8 — docker-build job in CI builds the Dockerfile end-to-end and smoke-tests both boot-refusal (no MCP_AUTH_TOKEN) and boot-success (with MCP_ALLOW_UNAUTHED=1).

Connector Directory readiness

• PRIVACY.md — what the server processes per request, what it never stores, what it logs (and doesn't), third parties called.
• README Three usage examples section — hero image with color, B-roll video bounded by duration, visual-pick shortlist via pexels_preview_media.

Tests

• 65 tests (was 59), green on Python 3.10 / 3.11 / 3.12.
• New tests/test_logging.py (6 tests) covering _JsonFormatter and LOG_FORMAT resolution.

Remaining for Directory submission

• A dedicated Pexels API key to hand Anthropic reviewers (lives outside the repo).
• Fill out the Directory submission Google Form with the deployed Koyeb URL, PRIVACY.md link, README link, the 3 examples, the test key.

Full changelog

https://github.com/VictorNain26/pexels-mcp-server/blob/v0.6.0/CHANGELOG.md

v0.5.0 - Dependabot auto-merge policy

Adds a Dependabot auto-merge policy workflow. Reduces weekly PR noise on safe bumps without giving up human review for the risky ones.

Policy

Update	Action
Patch (any ecosystem, any dep type)	Auto-merge once CI green
Minor — dev deps (ruff, mypy, pytest*)	Auto-merge once CI green
Minor — GitHub Actions	Auto-merge once CI green
Minor — runtime (mcp, httpx, pydantic, uvicorn)	Manual review, workflow posts a comment
Major (any ecosystem)	Manual review, workflow posts a comment

Setup

• Repo-level Allow auto-merge is now ON.
• Workflow uses dependabot/fetch-metadata@v2 to introspect each bump.
• Recommendation: enable branch protection on main requiring the CI status checks so auto-merge waits for the matrix to pass.

Full changelog

https://github.com/VictorNain26/pexels-mcp-server/blob/v0.5.0/CHANGELOG.md

v0.4.0 - Process all medium audit findings

Processes the full Medium-level batch from the May 2026 security + DevOps audits, plus the deferred HIGH-severity result.error sanitization. No breaking changes.

Security

• H3 — pexels_preview_media summary error sanitized (max 80 chars, single line) before model injection.
• M1 — previews.py HTTP client now uses follow_redirects=False; closes the redirect-chain SSRF vector.
• M3 — collection_id validated against ^[A-Za-z0-9_-]+$.
• M4 — locale validated against the documented SUPPORTED_LOCALES allowlist.
• M5 — publish.yml re-enabled with the tag trigger, mandatory needs: test gate, pypi deployment environment guard.
• L1 — Bearer auth log records only the remote IP (not port).

DevOps / SRE

• GET /readyz readiness probe added alongside /healthz.
• ghcr.io/astral-sh/uv:0.7 pinned to OCI digest sha256:6292…cc70.
• Retry backoff is now jittered (base 1.0s × [0.25, 0.75]) — fixes event-loop stalls during bursty AI sessions.
• Dependabot groups mcp / httpx / pydantic / uvicorn minor+patch bumps into one weekly runtime-dependencies PR.

Test coverage

• New tests/test_transport.py (12 tests) covers all three ASGI middlewares.
• 59 tests total (vs 41 in v0.3.0), all green on Python 3.10 / 3.11 / 3.12.

Full changelog

https://github.com/VictorNain26/pexels-mcp-server/blob/v0.4.0/CHANGELOG.md

v0.3.0 - Production hardening

Production hardening release. Bundles the Critical/Blocker findings from the May 2026 security + DevOps audits.

Highlights

• Stateless streamable HTTP — stateless_http=True, json_response=True on FastMCP. Horizontal scaling on Koyeb / Fly / Cloud Run without sticky sessions. Aligns with the MCP draft spec direction (sessions removed).
• Mandatory MCP_AUTH_TOKEN in HTTP mode (BREAKING) — process exits with code 2 if unset. Closes the gap where an operator could ship an open /mcp endpoint and silently burn the fallback Pexels quota. Local dev override: MCP_ALLOW_UNAUTHED=1.
• Graceful shutdown — timeout_graceful_shutdown=8 so in-flight tool calls survive Koyeb's ~10s SIGTERM window during rolling deploys.
• Dockerfile cache fix — split COPY src from the lockfile copy so the deps-only uv sync layer caches independently of source changes.
• Visual-pick tool (pexels_preview_media) and per-request Pexels key via X-Pexels-Api-Key consolidated from Unreleased.

Breaking changes

Set MCP_AUTH_TOKEN on the Koyeb env before deploying this version, or boot fails immediately.

Full changelog

https://github.com/VictorNain26/pexels-mcp-server/blob/v0.3.0/CHANGELOG.md