v0.4.7

Fixed

• Fix withings_list_body_measures date-window handling for large accounts: after / before are converted to Withings startdate / enddate Unix timestamps before the upstream call.
• Stop forwarding internal MCP-only parameters such as after, before, page, privacy_mode and response_format to the Withings API.
• Cap returned collection records locally using limit, so an upstream response with hundreds of body-measure records does not exceed MCP client message limits.
• Replace silent invalid-date fallback with a clear ISO 8601 error.

Security

• Update the lockfile away from vulnerable hono and esbuild transitive versions. npm audit --audit-level=low is clean.

Verification

• npm test
• npm audit --audit-level=low
• npm pack --dry-run
• GitHub CI and CodeQL on 61f0017