Skip to content

v2.1.0-r2

Choose a tag to compare

View all tags
@gusocegodk gusocegodk released this 06 Oct 11:40
· 3 commits to main since this release
v2.1.0-r2
716c1de
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security and correctness fixes from a full-codebase review.

Security

  • x-bookstack-url must be on BOOKSTACK_ALLOWED_BASE_URLS and come with x-bookstack-token. The configured token is never sent to a host the caller picks, and redirects are no longer followed.
  • file_path uploads need BOOKSTACK_UPLOAD_ROOT under every transport.
  • Page parsing runs in linear time (ReDoS fix).
  • Errors returned to callers carry no stack traces or server paths.
  • axios is now 1.20.0.

Correctness

  • Page sections skip fenced code, include their subsections, and report the heading they matched.
  • grep context can be used as old_string.
  • Tool failures are isError results the model can read. Resource templates are listed via resources/templates/list. GET/DELETE /message answers 405.
  • Network failures on read requests are retried and reported clearly.

Breaking changes

  • x-bookstack-url requires BOOKSTACK_ALLOWED_BASE_URLS and x-bookstack-token.
  • stdio file_path requires BOOKSTACK_UPLOAD_ROOT.
  • Tool errors are isError results instead of JSON-RPC errors.
  • Templated resources moved to resources/templates/list.

Image

ghcr.io/cego/bookstack-mcp-server:2.1.0-r2@sha256:7719340115df7e58ccc9b01b7af4b0c418b0a07558498b8e8710a08100e9952d

linux/amd64, with provenance and an SBOM.

Assets 2
Loading