Skip to content

v0.5.0 — licence and security compliance

Choose a tag to compare

View all tags
@bassotov bassotov released this 28 Jul 20:58
v0.5.0
2d2054d

Compliance pass against the MCP Directory Terms. No functional change.

  • A security reporting channel. The terms require "a mechanism for receiving reports of security vulnerabilities." There was none — a public issue was the only route, which turns a report into a zero-day the moment it is filed. GitHub private vulnerability reporting is now enabled, and SECURITY.md documents the channel, response times and the threat model.
  • Font licence compliance. Bundling the typefaces in v0.4.0 made deck a redistributor of them. All four are SIL OFL 1.1, which requires the copyright notice and licence to travel with the font software; the .woff2 files shipped with neither. THIRD-PARTY-LICENSES.md now carries all four notices verbatim, in the repo and inside the bundle.

deck-0.5.0.mcpb below is the build to submit.

Assets 3
Loading