Skip to content

v1.3.0 — companion skill + binary-planting hardening

Choose a tag to compare

View all tags
@danielsimonjr danielsimonjr released this 13 Aug 04:15
· 8 commits to main since this release
v1.3.0
7c094cb

Rolls up two gaps. The companion skill (fzf-mcp:fzf, /fzf) had been reserved
as 1.2.0 in the plugin manifest and marketplace since 2026-07-06 but never
made it into package.json, a git tag, or npm. This release carries it
forward together with real security hardening added since:

  • Resolve the fzf binary, findstr, and archive extraction to absolute paths
    only — closes a CWE-426/427 binary-planting exposure on Windows where
    CreateProcess searches the CWD before PATH.
  • Archive extraction now uses System32 bsdtar instead of PowerShell
    Expand-Archive, which fails to load on some Windows hosts.
  • @hono/node-server forced to >=2.0.5 (Dependabot #29, path traversal).
  • Windows CI leg added — this server's production platform had never been
    tested in CI.

Full detail in CHANGELOG.md.

Assets 2
Loading