Skip to content

v0.1.17: Cover-URL path-traversal fix, 404 normalization, mcp-ts-core ^0.10.14 adoption

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 13 Jul 17:15
v0.1.17
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
d3190d4
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

Cover-URL path-traversal fix, 404 normalization, mcp-ts-core ^0.10.14 adoption

Also adopts @cyanheads/mcp-ts-core ^0.10.14 with Bun supply-chain hardening (minimumReleaseAge guard, Socket install scanner).

Fixed:

  • Upstream 404s now normalize to the declared not_found contract instead of leaking a raw FetchHttpError, via a new fetchOrNull() wrapper (#8)
  • openlibrary_get_edition rejects non-numeric OCLC identifiers locally before the upstream call (#12)

Security:

  • openlibrary_get_cover_url and getCoverUrl() reject identifiers containing path separators, .., or control characters, and reject target: author paired with id_type: isbn, before any URL is built (#9)

Dependency bumps:

  • @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.14
  • @socketsecurity/bun-security-scanner new, ^1.1.2
  • @biomejs/biome ^2.5.0 → 2.5.2
  • js-yaml (transitive) 3.14.2 → 3.15.0 — clears GHSA-h67p-54hq-rp68

204 tests pass; bun run devcheck clean.

CHANGELOG v0.1.17

Assets 3
Loading