v0.7.1

0.7.1 is a public-preview security and correctness release for the core library and optional Spring WebFlux adapter. It introduces no new public API or binary deltas.

Maven coordinates

io.github.dtkmn:mcp-gateway-core:0.7.1
io.github.dtkmn:mcp-gateway-spring-webflux:0.7.1

Highlights

• Updates the WebFlux adapter's default jackson-databind dependency to 2.21.5, addressing CVE-2026-54515.
• Hardens UrlScope against encoded-path, malformed UTF-8, authority, port, and host parser differentials.
• Fixes concurrent token-bucket creation, eviction, capacity, overflow, and policy-change edge cases.
• Closes WebFlux request-governance bypasses involving context paths, matrix parameters, duplicate JSON fields, padded identifiers, downstream buffer errors, unsafe correlation data, and scope handling.
• Strengthens release integrity with immutable GitHub Action SHAs, structural workflow validation, Gradle Wrapper verification, and a main-only independently approved release environment.
• Prevents reuse of published Maven versions and verifies signatures against the configured primary-key fingerprint, including signing-subkey releases.

Verification and provenance

The release passed development CI, CodeQL, Snyk, documentation builds, closed-world artifact and signature checks, and clean Java 17 consumer tests for both modules. Compatibility was also checked against the frozen 0.6.0 consumer surface.

After publication, all 48 expected files for both coordinates were retrieved from Maven Central and matched the approved upload bundle byte for byte. A fresh external Java 17 consumer resolved and ran both modules with Maven Central as its only repository.

The annotated v0.7.1 tag points to exact uploaded source commit 0f5fe82da70fc335f0e0fc9e93833621077d1064. Post-publication documentation was finalized separately in PR #34, so the immutable source-provenance tag was not moved.

See the finalized release notes for the complete change list.

v0.7.0

Public-preview hardening release for MCP Gateway Core.

Highlights:

• Adds compatibility gates against the frozen 0.6.0 API baseline and accepted-delta registry.
• Hardens Spring WebFlux request-shape handling to fail closed when governance is active.
• Adds invalid-request observer support while preserving existing constructors.
• Pins inactive-governance pass-through behavior and WebFlux body replay.
• Strengthens Java 17 consumer smoke tests, frozen 0.6.0 source-compat checks, docs, and release/security policy.

Published artifacts:

• io.github.dtkmn:mcp-gateway-core:0.7.0
• io.github.dtkmn:mcp-gateway-spring-webflux:0.7.0

See docs/RELEASE_NOTES.md for the detailed API, binary, and behavior notes.

v0.6.0

Public-preview release for the MCP Gateway Core Java API and Spring WebFlux adapter.

Published Maven coordinates:

• io.github.dtkmn:mcp-gateway-core:0.6.0
• io.github.dtkmn:mcp-gateway-spring-webflux:0.6.0

Highlights:

• Adds the gateway governance orchestration surface for tool authorization and abuse-protection decisions.
• Consolidates the Spring WebFlux adapter around the governance filter path.
• Keeps the core artifact MCP-neutral, JDK-only, and Java 17-compatible.
• Updates build, docs, and test dependencies used by the public-preview release path.

Validated with:

• ./gradlew verifyGatewayPublicPreviewPublication --no-daemon --stacktrace
• ./bin/java17-consumer-smoke.sh

This remains a public-preview release. APIs may still change before a stable compatibility gate exists.