Skip to content

v0.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 21:31
v0.4.2
59c31d0

0.4.2 (2026-09-08)

🚀 Features

  • add ADT proxy server with JSON↔XML conversion (49271e22)
  • expose typed CTS transport metadata (#186)
  • adt-flow: add incremental transport checkout (#150)
  • adt-mcp: enforce destination scopes (3bbb9bf9)
  • adt-mcp: verify signed invocations (f782bf4f)
  • adt-mcp: enforce frozen AI Review reads (3c19a052)
  • adt-mcp: scope frozen reads to components (2676ae8f)
  • adt-mcp: scope ATC runs without raw URIs (6665107c)
  • adt-mcp: reject raw URI read targets (c206c1d4)
  • adt-mcp: scope autonomous agent reads (7baa09f8)
  • adt-mcp: classify bounded analysis execution (f1d19e7b)
  • adt-mcp: classify bounded analysis execution (#141)
  • adt-mcp: enforce scoped safe execution (#143)
  • adt-mcp: add delegated assistant read scope (b59006b4)
  • adt-mcp: add delegated assistant read scope (#148)
  • adt-mcp: arc-1 SAPRead parity for get_source (#162)
  • adt-server: add guarded MCP sidecar (ebd6f5f5)
  • adt-server: configure signed MCP runtime (d74109ef)
  • adt-server: add capability-bound source reads (c07df84d)
  • adt-server: allow local REST bearer auth (eff9104d)
  • adt-server: normalize system transport search (e9b0779e)
  • adt-server: release broker leases with audit (90a43953)
  • adt-server: add canonical transport detail REST (d6a74218)
  • adt-server: schema capability source responses (28a77ab5)
  • adt-server: paginate canonical package search (96c41c30)
  • adt-server: paginate canonical object search (9e43a2ad)
  • adt-server: require shared REST state secrets (d031b846)
  • adt-server: page direct package objects (f7971303)
  • adt-server: add canonical object metadata REST (be7857dd)
  • adt-server: add canonical object history REST (40ba0aa5)
  • adt-server: add bounded object source REST (05ce2705)
  • adt-server: add canonical ATC REST (0c16a8f3)
  • adt-server: generate typed REST client (7ac85f6c)
  • adt-server: wire safe_execute hooks from environment URLs (#146)
  • badi: add adt badi <name> --implementations (#153)
  • badi: classic BAdI read via vit/wb (#153, #154)
  • cds: support CDS and RAP ABAP File Formats (#183)
  • cts: create verified transport tasks (99447319)
  • flow: persist complete CTS inventories (#182)
  • flow: report partial transport import gaps (#190)
  • gcts: Full AFF abap-file-formats support — Wave 0+1+2 (#193)
  • mcp: bound current source reads (e8da7e53)
  • source-history: add bounded ADT source history support (04ecb578)

🩹 Fixes

  • address CodeRabbit review feedback (a9676264)
  • address all review feedback - round 2 (bbef42f2)
  • address CI feedback - error handling, fetch timeout, server crash risk (0f2bb0c5)
  • use bunx instead of npx in auth hint (89fc796b)
  • address 3 blocking issues in ADT proxy rework (c259a4e8)
  • address CI review feedback - security, reliability, and code quality (4d540802)
  • address CI failures - remove dynamic RegExp, fix lint errors, add NX Cloud fallback (66837675)
  • review thread fixes (broker, session, source-history, docs, deps) (3d20361a)
  • verify CTS lifecycle and task deltas (cbe83c5b)
  • verify CTS lifecycle, task creation, and lock correlation (#151)
  • CTS lifecycle follow-ups — lock correlation, release details, flow scope (#157)
  • resolve R3TR function modules via function groups (#187)
  • adk: exclude SUSK CTS entries from source manifests (#164)
  • adk: skip unmaterializable transport objects (#168)
  • adk: release transport task via newreleasejobs, verify by reload (#173)
  • adk: resolve LIMU function module owners (#188)
  • adk: keep FUGR function module sources distinct (#191)
  • adt-cli: normalize source-history metadata output to avoid leaking source URIs (4fbe2a8f)
  • adt-flow: ignore CTS release metadata during checkout (#156)
  • adt-mcp: freeze destination access (8f3fc5c5)
  • adt-mcp: include objectUri in find_references and accept uri in get_source_version (a1cdc51b)
  • adt-mcp,adt-server,adt-server-client: resolve ESLint errors and unsafe finally (cfe1c434)
  • adt-server: pass explicit authTagLength to aes-256-gcm decipher (5186a0d4)
  • adt-server: require capability secrets in startAdtServer, use test helper in server tests (d491cfae)
  • adt-server: guard capability services behind rest/mcp, share secret assertion (d43cc8a1)
  • atc: resolve abapGit paths from full ATC locations (#194)
  • aunit: preserve coverage measurement links (#175)
  • aunit: parse external coverage measurement URI (#176)
  • aunit: send SAP coverage query bodies (#179)
  • aunit: emit GitLab-resolvable JaCoCo paths (#181)
  • broker: suppress Codacy SSRF false positive after UAA URL validation (53a01945)
  • broker: use nosemgrep to suppress validated UAA fetch finding (73829783)
  • broker: use node:https for UAA token to avoid Codacy fetch SSRF false positive (f30fabc8)
  • cli: honor lock correlation on source writes (b2763ef7)
  • cli: honor explicit config for plugins (#163)
  • cli: keep payload stdout pipe-safe (#165)
  • cli: expose safe fetch failure diagnostics (#174)
  • client: support long-running SAP requests (#177)
  • client: pair timeout agent with undici fetch (#178)
  • codacy: suppress false-positive SSRF and object-injection findings (05c807bc)
  • codacy: avoid object-injection and user-controlled URL findings (9c3a249a)
  • codacy: suppress SSRF false positive on validated ADT URL (842c2341)
  • codacy: use bare nosemgrep suppression for fetch URL (fd406ad3)
  • codacy: resolve open code-scanning alerts (#167)
  • coverage: request SAP XML responses (#180)
  • cts: harden task creation verification (bb8d5862)
  • cts: preserve task identity from SAP response (6bd4d02d)
  • cts: prefer authoritative task number (18266a60)
  • cts: reconcile task and source lifecycle (34469d91)
  • flow: skip unsupported transport objects (#166)
  • flow: ignore unsupported manifest diagnostics (#172)
  • import: support typed CDS and RAP imports (#185)
  • lint: use const for defaultHeaders in proxy command (8ebef5f4)
  • mcp: bind immutable sources to capabilities (ad45ebc4)
  • proxy: skip set-cookie in forEach loop to prevent header flattening (46a1ca47)
  • quality: resolve open GitHub Code Quality findings (#159)
  • sast: add bearer suppression and reduce registry nesting (b0d7b17a)
  • server: propagate request cancellation through ADT Server (#160)
  • sonar: resolve S2187 tests and triage cognitive complexity with NOSONAR (25c39e09)
  • sonar: add assertions to tests and suppress remaining complexity findings (983b2dd7)
  • sonar: resolve MAJOR code smells and regenerate client (1559c2cd)
  • sonar: resolve S4144, S6551, S6571, S6582, S6644, S7750, S7755, S7786, S5332 (35b25a45)
  • sonar/codacy: reduce destination-mode complexity and add test wrappers (d0c8413f)
  • source-capabilities: require explicit secret or allowEphemeralSecret opt-in (c421fba2)
  • ts-xsd: quote XML property names in generated types (#192)

❤️ Thank You

Contributors

Octember, ThePlenkov, and 2 other contributors
Assets 2
Loading