v2.8.0 — Enhanced Security and Dependency Updates

This release improves security and updates vital dependencies for continued compatibility and performance.

✨ Highlights

Improved HTTP Request Handling. Blob handling is now more robust, ensuring secure file uploads.

form.append(k, new Blob([new Uint8Array(v)]));

🔒 Security

• Addressed SSRF vulnerability: all HTTP requests open a fresh socket, eliminating the risk of reusing pooled keep-alive sockets.

🛠 Also in this release

• Drop support for Node < 22.19 — facilitates using the latest Node.js features.
• Updated @apidevtools/json-schema-ref-parser to v16 — improves schema validation.

⚠️ Upgrading

Change	Impact
Node version requirement	Now requires Node >= 22.19.

Full change list

Fixes

• fix(ssrf): never reuse pooled keep-alive sockets in the pinned transport

Security

• chore(deps)!: bump @apidevtools/json-schema-ref-parser to 16 and require Node >= 22.19

Features

• chore(release): initialize release/2.8.x at v2.8.0
• chore(deps-dev): bump jest 30, @swc/core 1.16, esbuild 0.28, @types/node 26, @types/jest 30, zod 4.6
• chore(deps): bump yaml from 2.9.0 to 2.9.1

Installation

npm install mcp-from-openapi@2.8.0

---

_{Release line: 2.8.x · Branch: release/2.8.x · Type: stable}