Skip to content

v2.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jun 21:54
· 74 commits to main since this release
v2.5.0
a8c0ff2

Release v2.5.0

Release type: stable
Release line: 2.5.x
Branch: release/2.5.x

[2.5.0] - 2026-06-21

Security

  • Enhanced SSRF protection by resolving DNS and blocking internal targets based on resolved IPs, not just hostnames.
  • Implemented safeFetch to revalidate each redirect hop, closing potential SSRF bypasses.
  • Introduced normalizeSsrfOptions to manage SSRF-related configurations consistently.

Added

  • Added SsrfError class to handle specific SSRF guard violations.
  • Exported SSRF utilities like safeFetch, isBlockedHostname, and decodeIpv4MappedIpv6 for external use.

Changed

  • Refactored fromURL and $ref resolution to use new SSRF utilities for heightened security.
  • Updated RefResolutionOptions and LoadOptions documentation to reflect enhanced SSRF features.

Installation

npm install mcp-from-openapi@2.5.0
Assets 2
Loading