Skip to content

v0.1.10: SODA error classification, invalid app token, canvas reachability, security

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 04 Jul 19:19
v0.1.10
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
e5373d1
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

SODA error classification, invalid app token, canvas reachability, security

Five bug fixes plus a lockfile refresh that clears every previously-flagged advisory.

Fixed

  • socrata_query_dataset: SODA 400 bodies keyed errorCode (query-coordinator errors) fell through to a generic HTTP error and lost the upstream message. fetchJson now accepts either code or errorCode and always throws soql_error; the catch block re-throws soql_error/rate_limited through ctx.fail so the recovery hint reaches the wire. (#2)
  • socrata_get_dataset, socrata_query_dataset, socrata_find_datasets: an invalid SOCRATA_APP_TOKEN surfaced as a generic Forbidden. A 403 permission_denied body mentioning the app token now throws invalid_app_token (ConfigurationError) without leaking the token value; find-datasets.tool.ts gained the try/catch it was missing entirely. (#10)
  • socrata_query_dataset: grouped/aggregate queries reported total_count as the raw source-row count. The recount is now skipped when group is set. (#11)
  • socrata_dataframe_describe: omitting canvas_id silently created and described an empty canvas. Now throws canvas_id_required; every surface promising a nonexistent listing behavior corrected. (#15)
  • DataCanvas was unreachable on every transport — handlers read ctx.core?.canvas, which the framework never populates. New src/services/canvas-accessor.ts wired from setup(core) fixes all three touchpoints. (#15)
  • socrata_query_dataset: canvas spillover silently failed on datasets with :@computed_region_* columns. These are now stripped from the canvas projection before registerTable. (#16)

Changed

  • Vendored skills re-synced (api-utils/parsing, polish-docs-meta/readme); README ## Contributing section removed to match.

Security

Lockfile refresh from the mcp-ts-core adoption clears all 8 flagged advisories (2 high, 6 moderate):

Dependency bumps:

  • @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10
  • @biomejs/biome ^2.5.0 → ^2.5.2
  • @types/node ^26.0.0 → ^26.1.0
  • tsc-alias ^1.8.17 → ^1.9.0

122 tests pass; bun run devcheck clean.

Assets 3
Loading