Skip to content

v0.5.5: SSRF guard hardening, statuspage_unavailable reachability

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 30 Jul 19:25
v0.5.5
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
c34a2cb
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

SSRF guard hardening, statuspage_unavailable reachability

  • SSRF guard now blocks 0.0.0.0/8, the bare IPv6 unspecified address (::), and ip:port resolver forms that previously bypassed the private-target check (#29)
  • Redirects are re-validated against the SSRF guard on every hop instead of being followed unchecked, capped at 5 hops (#30)
  • Vendor fetch failures now map onto the declared statuspage_unavailable contract instead of surfacing raw JavaScript errors; devops_status_check's unreachable contract entry removed, Statuspage responses gain runtime shape validation (#32)
  • mcp-ts-core 0.11.0 adoption: bundle strips native bindings too, packaging/devcheck tooling and skill docs synced
  • deps: @cyanheads/mcp-ts-core ^0.10.14 → ^0.11.0

CHANGELOG v0.5.5

Assets 3
Loading