Skip to content

2.4.0-rc.21

Pre-release
Pre-release

Choose a tag to compare

View all tags
@lakhansamani lakhansamani released this 14 Aug 06:20
· 19 commits to main since this release
2.4.0-rc.21
a0e64eb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release candidate for 2.4.0.

Since 2.4.0-rc.20

  • authorizer mcp now honours --url. The subcommand inherits the root flag set, so --url was always accepted there, but parsers.SetTrustedURL was only called from the server's startup path — so it silently did nothing and issuer validation stayed on header derivation (#768).
  • --mcp-authorizer-url is deprecated and inert. Pass --url with the same value. Still parsed so existing setups keep starting; it warns and is ignored, and goes away in 2.5.0 with the subcommand (#768).
  • --mcp-bearer without --url is refused at startup, instead of failing later as a bare Unauthenticated on every tool call (#768).
  • Docs/changelog corrections for --url becoming mandatory: the flag's own --help still described it as optional (#767), and the change was absent from the changelog (#766).

Upgrading from 2.3.x

--url is required as of 2.4.0 — the server refuses to start without it. It is not --allowed-origins: --url is this server's own address, --allowed-origins is the apps it may redirect to. See Trusted base URL.

--encryption-key is required for RS*/ES* deployments.

Full detail in CHANGELOG.md.

Assets 2
Loading