Skip to content

v1.5.6

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 21:03
v1.5.6
744897a

Release v1.5.6

Release type: stable
Release line: 1.5.x
Branch: release/1.5.x

Installation

npm install @frontmcp/sdk@1.5.6

What's New

CHANGELOG

Features

  • SSRF Protection: Introduced SSRF policy options for the OpenAPI Spec Poller, enhancing security by blocking internal/private addresses by default. This ensures safer URL polling, aligning with the initial spec load security measures.

Improvements

  • Redirect Handling: Added support for following and re-validating redirect hops during OpenAPI spec polling. This mirrors the adapter's spec-load redirect policy, providing more robust and flexible URL handling.

Bug Fixes

  • Security Enhancement: Replaced raw fetch requests with safeFetch in the OpenAPI Spec Poller to guard against potential SSRF vulnerabilities. This update addresses security advisory GHSA-65h7-9wrw-629c, ensuring safer network operations.

What's Changed

  • fix: enhance SSRF protection in OpenAPI polling to block internal addresses by default and allow configuration for trusted environments by @frontegg-david in #510

Full Changelog: v1.5.5...v1.5.6

🙏 Acknowledgments

Thanks to Song Jihoon @EchoSkorJjj for responsibly reporting the OpenAPI spec-poller SSRF fixed in this release — a follow-up to GHSA-65h7-9wrw-629c.

Contributors

frontegg-david and EchoSkorJjj
Assets 2
Loading