Release v1.8.0

Release type: stable
Release line: 1.8.x
Branch: release/1.8.x

npm install @frontmcp/sdk@1.8.0

CHANGELOG

Static Authentication Mode: Introduced a new 'static' mode for authentication, allowing the use of a fixed shared secret for every request. This simplifies setups that do not require OAuth or JWT, providing a straightforward API key mechanism.
Cloudflare Worker Enhancements: Added support for Cloudflare Workers with improved configuration management. This includes automatic handling of compatibility flags and environment variable bridging, ensuring seamless deployment and operation.

IPv6 Address Handling: Enhanced security checks for IPv6 addresses by normalizing them before validation. This ensures all equivalent spellings of an address are correctly recognized and processed.
JWT Security Enhancements: Introduced stricter requirements for JWT secrets, including checks for minimum byte length to prevent weak secret usage. This improves the overall security posture of token handling.
Cloudflare Deployment Configuration: Improved the merging of wrangler.toml configurations to preserve user-defined settings while ensuring necessary defaults are applied. This prevents accidental overwrites of critical deployment configurations.

Redirect Handling in OpenAPI Tool: Fixed a security issue (GHSA-qh67-4345-cw2q) where redirects were automatically followed, potentially exposing credentials. Now, redirects are surfaced as failures to protect sensitive information.

Cherry-pick: fix: Bind loopback and disable CORS by default; drop eval from a skill example by @github-actions[bot] in #522
chore: forward-port the 1.7.2 security fixes to main by @frontegg-david in #532
fix(cli): run tsc through the project resolver, stop the ESM warning, clean outDir by @frontegg-david in #547
fix(cloudflare): make the Workers target work out of the box by @frontegg-david in #548
fix(testing,auth): load .env in test, conditional skip, entryPath, static auth mode by @frontegg-david in #549
security: close all 12 unpublished advisories (1 critical, 7 high, 4 moderate) by @frontegg-david in #550

Full Changelog: v1.7.2...v1.8.0