v0.19.1

In short

• Security fix: updateEvent and deleteEvent no longer change or delete a task given its id. They did so even
  when updateTask or deleteTask was disabled in the options page. Updating is recommended.
• The bridge does not change (0.19.0).

How to update

• Thunderbird add-on: it updates itself. To get this version now: Add-ons and Themes, gear menu, Check for Updates, then restart Thunderbird. For a first installation, see the README (commonpost-mcp-v0.19.1.xpi below).
• MCP bridge: it is installed in your MCP client and is never updated automatically. This release ships the same bridge as v0.19.0: a bridge of version 0.19.0 needs no update.
  • Claude Desktop: download commonpost-mcp-v0.19.0.mcpb below and open it with Claude Desktop; if the file does not open there (Windows), use Settings > Extensions > Advanced settings > Install Extension.
  • Claude Code with the plugin: /plugin marketplace update commonpost (or turn on auto-update for the marketplace in /plugin), then /reload-plugins. The plugin always carries the bridge of the release.
  • Other clients (Claude Code without the plugin, Cursor, VS Code, ...): download mcp-bridge.cjs below and put it in place of your copy, then restart the client or reconnect the server (/mcp in Claude Code). The path of your copy is in the MCP configuration of the client (Claude Code: claude mcp get <server name>).
  • Not sure which bridges you have? The options page of the add-on (section Bridge) lists the bridges that connected, each with its version and "Up to date", "Newer version available" or "Update recommended". Claude Desktop and another client on the same computer are two bridges, updated separately.

The .sigstore.json and .intoto.jsonl files are provenance attestations, not something to install.

All changes

Security

• updateEvent and deleteEvent refuse the id of a task (Event not found). Thunderbird looks up events and tasks
  by the same ids, so they changed or deleted a task given its id, even when the tool settings kept updateTask or
  deleteTask disabled. They now find events only, as updateTask and deleteTask find tasks only since 0.19.0.