Skip to content

v1.4.4 - Docker Hub Build Fix & Security Hardening

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Dec 20:02
· 439 commits to master since this release
v1.4.4
6c35818

CyberChef MCP Server v1.4.4 Release Notes

Release Date: 2025-12-14
Type: Patch Release (Build Fixes & Security Hardening)

Overview

Version 1.4.4 resolves critical Docker Hub build failures that prevented v1.4.2 and v1.4.3 from building successfully in CI/CD, and addresses 12 security vulnerabilities in the web UI. This release also adds comprehensive GitHub Copilot instructions to improve AI-assisted development workflow.

Critical Build Fix

Docker Hub Webpack Compilation Failures

Root Cause: Corrupted package @natlibfi/loglevel-message-prefix@3.0.1 contains invalid import path

// CORRUPTED (lib/main.js line 39):
import polyfills from '@natlibfi(es6-polyfills';

// CORRECT:
import polyfills from '@natlibfi/es6-polyfills';

Impact: All 5 web workers failed to compile, causing complete build failures in Docker Hub CI/CD

Solution:

  1. Automated Fix: New postinstall script uses sed to correct the import path
  2. Memory Optimization: Added NODE_OPTIONS="--max-old-space-size=4096" for Docker Hub builds
  3. Webpack Tuning: Reduced parallelism to 1, enhanced stats visibility
  4. Plugin Resilience: Made BundleAnalyzerPlugin non-fatal

Result: Docker Hub builds now succeed reliably (98s compile time, 285MB image)

Security Fixes (12 Vulnerabilities)

All fixes are in web UI only - MCP server unaffected.

Critical: Code Injection (OutputWaiter.mjs)

Before: Unsafe code execution from user-controlled data
After: Safe DOM script element creation
Impact: Prevents arbitrary code execution

High: XSS Prevention Enhancements

Attribute Allowlist: Only safe attributes permitted

  • Allowed: id, class, value, data-* attributes
  • All other attributes removed

Value Validation: Comprehensive protocol injection prevention

  • Blocks javascript: protocol
  • Blocks data: URIs
  • Detects URL-encoded obfuscation (%6A%61%76%61%73%63%72%69%70%74:)
  • Case-insensitive matching

Protocol Validation: Enhanced with startsWith() for reliability

GitHub Copilot Instructions

Added comprehensive development guidance:

Files:

  • .github/copilot-instructions.md (204 lines)
  • .github/agents/copilot-instructions.md (discovery copy)

Contents:

  • Quick Start workflow
  • Architecture overview
  • Code conventions
  • Common development tasks
  • Troubleshooting guide
  • Security considerations

Benefits:

  • Improved AI assistant accuracy
  • Faster contributor onboarding
  • Consistent code style

Testing & Validation

# All tests passing
npm test
✓ 1,933 unit tests (1,716 operation + 217 Node API)

# Build verification  
docker build -f Dockerfile.mcp -t cyberchef-mcp .
✓ Webpack 5.103.0 compiled in 98s
✓ All 5 worker compilations succeeded
✓ Image size: 285MB

# MCP server operational
npm run mcp
✓ All 465 tools functional

Upgrade Instructions

No breaking changes. Update via:

# Pull latest
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest

# Or rebuild
git pull origin master
git checkout v1.4.4
npm install
docker build -f Dockerfile.mcp -t cyberchef-mcp .

Files Changed

Build System:

  • Gruntfile.js - Added fixLoglevelMessagePrefix task
  • package.json - mcpVersion 1.4.3 → 1.4.4, postinstall script
  • webpack.config.js - Enhanced stats, reduced parallelism
  • Dockerfile - Memory optimization

Security:

  • src/web/waiters/OutputWaiter.mjs - Security hardening

Documentation:

  • .github/copilot-instructions.md - NEW
  • .github/agents/copilot-instructions.md - NEW
  • README.md - Version updated to v1.4.4
  • CHANGELOG.md - v1.4.4 section added

Docker Image

Registry: ghcr.io/doublegate/cyberchef-mcp_v1
Tags: v1.4.4, latest
Size: ~285MB compressed

# Pull
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.4

# Offline install
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.4.4/cyberchef-mcp-v1.4.4-docker-image.tar.gz
docker load < cyberchef-mcp-v1.4.4-docker-image.tar.gz

Contributors

Links

Previous Releases

Assets 4
Loading