3ngram 1.8.6

3ngram v1.8.6

Patch: the engine's runtime dependencies move to their newest releases past
the 7-day cooldown, the deprecated MCP server-legacy package is gone, and
zod moves to 4.6.5 with the datetime grammar unchanged.

Changes

• MCP SDK 2.3 (#302). @modelcontextprotocol/server 2.0.0 -> 2.3.1 and
  @modelcontextprotocol/node 2.0.0 -> 2.1.1 move together, leaving one
  @modelcontextprotocol/core in the graph. The tool, prompt and
  resource-template surface clients list is byte-for-byte unchanged. Three
  wire behaviours change; see Compatibility.

• server-legacy removed (#299, resolves #281). POST /oauth/token now builds its RFC 6749 errors from OAuthError in
  @modelcontextprotocol/server. Every token-endpoint error keeps its HTTP
  status, JSON body and headers, pinned byte for byte by a new unit suite.
  express-rate-limit and ip-address leave the graph, and the scoped
  ip-address advisory override is dropped.

• zod 4.6.5 (#300). zod 4.5 began requiring seconds on any time with Z
  or an offset; every datetime field now goes through the new
  isoDateTime() helper in @3ngram/schema, so minute precision such as
  2026-01-01T06:15Z still parses and the emitted date-time pattern is
  byte-identical. @3ngram/schema gains isoDateTime and
  IsoDateTimeOptions.

• Runtime minors (#296). nodemailer 10.0.16, rate-limiter-flexible
  11.2.1, pino 10.4.0, @node-rs/argon2 2.2.2, ipaddr.js 2.5.0 and
  jose 6.2.12. argon2 swapped its Rust backend; hashes keep the same PHC
  format and parameters, and a unit test verifies a hash minted by 2.0.2.
  argon2 2.2.2 drops the wasm32-wasi fallback, so a platform without a
  prebuilt native binding no longer falls back to WASM (every linux
  gnu/musl x64/arm64, darwin and win32 target still has one).

• Worker queue stack (#298). bullmq 5.81.5 and ioredis 5.11.1, one
  ioredis copy across server and worker. Since 5.81.2 BullMQ drops
  connection errors no listener receives, so the worker's Queue and Worker
  now register one each and log only the error name and queue name, never
  the message, which can quote stored job data.

• @sentry/node 10.76.0 (#295). Data collection, request-body capture
  and the beforeSend / beforeSendTransaction scrub are unchanged for
  this config.

• Security triage 2026-10-12 (#280). @modelcontextprotocol/client,
  vitest, js-yaml and source-map-js advisories cleared. Replacing
  the ioredis-mock test dependency with a local fake (#293) also removes
  sprintf-js (GHSA-hp3w-g68c-fv3c, no patched release) from the graph.

Compatibility

• zod lockstep. Consumers that compose @3ngram/schema schemas or types
  with their own zod must move to zod 4.6.5 at the same time: zod's
  declarations carry the minor version as a literal type, so mixing copies
  fails to typecheck. Upstream also counts string length bounds in Unicode
  code points, and emitted JSON Schema (MCP tools/list, OpenAPI) writes a
  nullable primitive as type: [T, "null"] instead of a two-branch
  anyOf.
• MCP wire. prompts/get for debrief with arguments omitted now
  renders the prompt instead of failing with -32602. A 2026-07-28 POST
  without the MCP-Protocol-Version header is refused with 400 / -32020
  (SDK clients always send it). A legacy JSON-RPC batch of more than 100
  messages is refused with 400 / -32600.

Operations

No migration and no configuration change.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:dc4da463bffb2aafbf9333391708a6695bd603d16cd803ecdac34199d12ec9db