audio-utils v0.8.1

The optional MCP HTTP gateway now includes patched URI and query parsers. This updates fast-uri to 3.1.7 and qs to 6.16.0, addressing upstream host-normalization flaws, query parsing denial of service, and array-limit bypasses.

Existing Bash converters and configuration remain compatible. The Node wrapper stays private and is not published separately to npm. Reinstall gateway dependencies with npm ci after upgrading the source checkout.

Validation: the repository checks, unit/smoke and functional suites, coverage gate, and all eight Node gateway tests passed. Four local replay-gain/key-tagging cases were skipped because their optional tools were unavailable. Hardware-dependent coverage exemptions remain documented in the repository.

The attached source archive is built from the signed release tag. Verify it with sha256sum -c SHA256SUMS before extracting.

audio-utils v0.8.0

Features

• Expose MCP controls with CLI option parity.
• Expand converter, audio, audit, library, and playlist workflow guidance.

Fixes

• Constrain temporary-workdir and cleanup deletion boundaries.
• Preserve unusual filenames in repository checks and cleanup tooling.
• Harden archive snapshot boundaries.

CI and maintenance

• Restore Fedora checks with the required cmp dependency.
• Bound Fedora concurrency and allow the complete cross-distro check sufficient time.
• Clarify local main synchronization after rebase merges.

Validation

• 212 unit and smoke tests passed.
• 276 functional tests passed; 9 environment/dependency checks skipped.
• 8 MCP gateway tests passed; npm reported 0 production vulnerabilities.
• 100% of testable tools have functional coverage.

v0.7.0

Highlights

• Strengthens Blu-ray-to-FLAC archival workflows with MakeMKV title extraction, ISO support, resumable staging, provenance, chapter sidecars, preservation manifests, snapshots, and fail-closed verification.
• Adds archive-audit for preservation-package verification, policy auditing, snapshot baselines, and drift detection.
• Expands audit rigor across CUE sheets, path collisions, gapless metadata, artwork, decode integrity, audiobook sequencing, and atomic report/image publication.
• Brings the MCP gateway to feature parity with the new Blu-ray archival and audit controls through typed schemas and safety-aware argument handling.
• Propagates finalizer failures and tightens shared archive, media, and conversion invariants.

Validation

• Full GitHub CI and CodeQL passed.
• Local unit/smoke: 192 passed.
• Local functional: 270 passed, 9 dependency/fixture skips.
• MCP Node tests: 8 passed; production dependency audit reported 0 vulnerabilities.
• Tool coverage: 90/90 testable tools (100%).

audio-utils v0.6.2

Features

• Preserve newline and Unicode paths across disc discovery, playlists, and MCP workflows.
• Expand NUL-delimited batch and discovery support for disc pipelines.

Fixes

• Validate numeric ranges, timing metadata, CUE indexes, permission modes, and custom CLI arguments more strictly.
• Harden playlist URI/XML handling, metadata normalization, and backend preflight checks.
• Make chapter metadata writes atomic and improve malformed MCP JSON/frame rejection.

Security and dependencies

• Use private XDG/runtime fallbacks and temporary error files, reject unsafe namespaces/templates, and ignore untrusted temporary config.
• npm audit reports 0 vulnerabilities; no dependency versions changed.

Validation

• Static, documentation, workflow, and CodeQL checks passed.
• 161 unit/smoke tests and 242 functional tests passed locally; 9 dependency/environment skips were reported.
• The full GitHub CI matrix passed on Ubuntu and Fedora.
• Coverage remains 100% of testable tools.

audio-utils v0.6.1

Security and dependency integrity

• Enforce full 40-character commit SHA pins for every third-party GitHub Action.
• Add regression tests and integrate action-pin validation into make check.
• Pin current workflow actions, including actions/setup-node v7, to verified immutable commits.

MCP gateway

• Upgrade Express from 4.22.2 to 5.2.1.
• Retain passing HTTP gateway, concurrency, session, origin, and error-handling coverage.

Validation

• Full local release playbook passed: static checks, 232 functional tests, 8 MCP tests, npm audit with zero vulnerabilities, actionlint, and 100% coverage of testable tools.
• Release PR CI and CodeQL passed.

audio-utils v0.6.0

Highlights

• Preserve spaces, Unicode, metacharacters, and embedded newlines across audio discovery, batch processing, playlists, audits, and conversion pipelines.
• Add roots-file configuration for libraries whose paths cannot be represented safely as a space-separated environment value.
• Harden the MCP HTTP/SSE gateway with shared session limits, idle cleanup, trusted host/origin checks, payload limits, and accurate client error responses.
• Pin keyfinder source builds to reviewed commits and report installed revisions.
• Add stronger CI coverage for MCP, documentation links and anchors, minimum runtimes, Fedora ShellCheck, and FFmpeg variants.

Dependencies and compatibility

• Update the MCP SDK to 1.30 and its resolved dependency tree, including Hono server 2.1.0, fast-uri 3.1.5, Hono 4.13.0, and ip-address 10.4.0.
• The optional Node MCP gateway now requires Node 20 or newer. The dependency-free Bash MCP server is unchanged.
• npm audit --omit=dev reports zero known vulnerabilities.

Validation

• 105 unit and smoke tests passed.
• 232 functional tests passed locally.
• GitHub CI passed CodeQL, documentation validation, Ubuntu and Fedora ShellCheck, Node 20 MCP tests, and functional matrices against distro and latest FFmpeg.
• Coverage audit reports 100% of testable tools.