v1.3.0

Highlights

• Added opt-in MCP 2026-07-28 support through a stateless modern HTTP adapter while preserving the legacy MCP SDK path and existing sessions by default.
• Added explicit downstream auto, legacy, and modern selection, modern server discovery, truthful capability filtering, and safer subscription-stream lifecycle handling.
• Hardened modern request validation, including exact Origin checks, OAuth scope/audience enforcement, bounded downstream SSE responses, and fail-closed mixed-era routing.

Fixes and improvements

• Preserved downstream server identity and complete permission replacement behavior.
• Added optional Peta Auth runtime-secret deployment with strict file validation and mount isolation.
• Updated the Node/runtime dependency baseline and patched production-reachable denial-of-service dependencies.
• Hardened Docker publication to build only the exact reviewed Git commit, require immutable semantic-version tags, verify both target platforms, and publish no latest alias.

Operational notes

• Modern MCP remains disabled by default. Enable it deliberately with MCP_2026_ENABLED and the documented downstream/canary settings.
• Modern downstream support in 1.3.0 is HTTP-only. Modern stdio, persistent downstream subscriptions, progress, and cancellation bridging remain explicitly unsupported.
• Reviewed source: 039a39234448a3b1a407e3b4b571b91d9bf68ff0
• Docker: bcdunia/peta-core:1.3.0@sha256:209bfcca9fb4458141247e604640fdb9901978880e48cb4fd3b23fe7639cb1f6
• Platforms: linux/amd64, linux/arm64
• No latest tag is published.