v0.2.1 — no cookies carried between HTTP callers

A security fix for the HTTP server. Upgrade every deployment that serves more than one user.

Security

• The server no longer keeps cookies from Azure DevOps. Over HTTP every caller shares one pooled connection handler, and in 0.2.0 it stored the cookies Azure DevOps set and sent them with later requests from other callers, next to those callers' own PATs. Each request now carries its caller's PAT and nothing another caller left behind. A new end-to-end test calls as two users in turn and fails if any request carries a cookie issued to someone else (#64)

stdio — the NuGet tool used by Copilot, Claude Code, and other local clients — serves a single user and was not affected.

Upgrading

• Docker: docker pull ghcr.io/exoz00rd/azuremcp:0.2.1 and recreate the container. Deployments following latest or 0.2 pick it up on their next pull
• Helm: helm upgrade to chart 0.2.1
• Open WebUI: the plugin is unchanged; nothing to do

62 tools, 470 tests.

Full changelog: v0.2.0...v0.2.1