Skip to content

v0.1.7: mcp-ts-core 0.10.14, Bun supply-chain hardening, find-pokemon + type-matchups fixes

Latest
Latest

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 11 Jul 17:07
v0.1.7
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
78d0305
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

mcp-ts-core 0.10.14, Bun supply-chain hardening, find-pokemon + type-matchups fixes

Added

  • Bun supply-chain guards via bunfig.toml: minimumReleaseAge blocks package versions published under 3 days old (@cyanheads/mcp-ts-core excluded, adopted same-day), and @socketsecurity/bun-security-scanner scans every install for malware/typosquats/CVEs
  • .github/SECURITY.md and .github/FUNDING.yml

Changed

  • pokeapi_find_pokemon's query-only empty-result notice now renders as a blockquote in content[] instead of the generic notice: label (#6)
  • pokeapi_get_type_matchups's composedMultipliers description now documents that the map includes net-neutral 1x cancellation entries for dual-type Pokemon (e.g. Charizard vs Ice composes to exactly 1x), not just non-neutral multipliers (#5)
  • docs/design.md: corrected two error-contract table entries from InvalidParams to ValidationError, and removed a phantom no_results reason pokeapi_find_pokemon never declared
  • Dockerfile: pinned oven/bun to 1.3.14 on both stages, added BuildKit cache mounts, and the build-stage install now runs with --ignore-scripts

Fixed

  • pokeapi_find_pokemon accepted negative limit/offset and returned a misleading success; both are now constrained integers, rejected by the SDK's input-schema validation before the handler runs (-32602 InvalidParams) (#7)
  • Cleared pre-existing Biome warnings: non-null assertions replaced with explicit guards, a redundant async keyword removed from eleven fetch* methods, bracket-notation switched to dot notation
  • scripts/devcheck.ts's outdated-dependency check no longer flags packages held back by the new minimumReleaseAge guard as unexpected

Dependencies

  • @cyanheads/mcp-ts-core ^0.10.9 -> ^0.10.14
  • typescript ^5.9.3 -> ^6.0.3
  • @types/node 26.0.0 -> ^26.0.0 (resolves 26.1.1)
  • @socketsecurity/bun-security-scanner (new) ^1.1.2
  • @biomejs/biome 2.5.0 -> 2.5.3, tsc-alias 1.8.17 -> 1.9.0, vitest 4.1.9 -> 4.1.10 (lockfile refresh, no package.json range change)

68 tests pass; bun run devcheck clean.

CHANGELOG v0.1.7

Assets 3
Loading