Skip to content

v3.8.3 — First release published from CI, with provenance and an attested SBOM

Choose a tag to compare

View all tags
@bvisible bvisible released this 28 Aug 12:13
· 20 commits to main since this release
v3.8.3
46a38d7

Changed

  • First release published from CI with build provenance and an attested SBOM. v3.8.2 shipped the workflow but was still published by hand, so it carried no attestation at all — while the comparable competitor had both an npm publish attestation and SLSA provenance. This one closes the gap for real:

    npm audit signatures

    mcp-ssh-manager@3.8.3 now carries npm/attestation/publish/v0.1 and slsa.dev/provenance/v1, so anyone can verify which commit and which workflow built the tarball. The signed statement is in the public Sigstore transparency log.

  • zod 3 → 4 (#65). Verified before merging rather than after: with zod 4 installed, all 37 tools still register over a real MCP stdio handshake, and the suite, typecheck and lint stay green. @modelcontextprotocol/sdk accepts ^3.25 || ^4.0, and knip already wanted ^4.1.11.

  • actions/checkout and actions/setup-node bumped to v7 (#61, #62).

Declined, on purpose

TypeScript 7 (#64) and ESLint 10 (#63) were closed rather than merged: knip 5 pins peer typescript ">=5.0.4 <7", so TypeScript 7 breaks npm ci outright, and ESLint 9+ needs a migration off .eslintrc to flat config — tracked in #66.

Full changelog: https://github.com/bvisible/mcp-ssh-manager/blob/main/CHANGELOG.md#383---2026-08-28

Assets 3
Loading