Skip to content

v0.7.1

Latest
Latest

Choose a tag to compare

View all tags
@dtkmn dtkmn released this 11 Jul 07:15
v0.7.1
0f5fe82
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.7.1 is a public-preview security and correctness release for the core library and optional Spring WebFlux adapter. It introduces no new public API or binary deltas.

Maven coordinates

io.github.dtkmn:mcp-gateway-core:0.7.1
io.github.dtkmn:mcp-gateway-spring-webflux:0.7.1

Highlights

  • Updates the WebFlux adapter's default jackson-databind dependency to 2.21.5, addressing CVE-2026-54515.
  • Hardens UrlScope against encoded-path, malformed UTF-8, authority, port, and host parser differentials.
  • Fixes concurrent token-bucket creation, eviction, capacity, overflow, and policy-change edge cases.
  • Closes WebFlux request-governance bypasses involving context paths, matrix parameters, duplicate JSON fields, padded identifiers, downstream buffer errors, unsafe correlation data, and scope handling.
  • Strengthens release integrity with immutable GitHub Action SHAs, structural workflow validation, Gradle Wrapper verification, and a main-only independently approved release environment.
  • Prevents reuse of published Maven versions and verifies signatures against the configured primary-key fingerprint, including signing-subkey releases.

Verification and provenance

The release passed development CI, CodeQL, Snyk, documentation builds, closed-world artifact and signature checks, and clean Java 17 consumer tests for both modules. Compatibility was also checked against the frozen 0.6.0 consumer surface.

After publication, all 48 expected files for both coordinates were retrieved from Maven Central and matched the approved upload bundle byte for byte. A fresh external Java 17 consumer resolved and ran both modules with Maven Central as its only repository.

The annotated v0.7.1 tag points to exact uploaded source commit 0f5fe82da70fc335f0e0fc9e93833621077d1064. Post-publication documentation was finalized separately in PR #34, so the immutable source-provenance tag was not moved.

See the finalized release notes for the complete change list.

Assets 2
Loading