Skip to content

v2.1.1

Choose a tag to compare

View all tags
@jedisct1 jedisct1 released this 26 May 23:47
· 21 commits to ng since this release
v2.1.1
d074d01

Patch release with security fixes and hardening.

Security

  • Reject ambiguous CLI option values rather than guessing intent.
  • Fix a Host header bypass in the HTTP transport that let requests skirt host validation.
  • Cap session creation to prevent memory exhaustion from unbounded sessions.

Hardening

  • The HTTP transport and sandbox plumbing have been tightened, and the doc index now covers more of the API surface.
  • The sandbox forwards NODE_EXTRA_CA_CERTS and NODE_USE_SYSTEM_CA, so enterprise CA bundles flow through.
  • Dependencies now have to be at least three days old before bun will install them.

Tooling

  • Replaced the bunx @fastly/mcp invocation in docs with the -p form.
  • Imported a package-lock.json for npm and Node users.
  • CI workflows are now zizmor-clean. A weekly zizmor audit job is added.
  • Releases publish through npm's trusted publisher system, with provenance attestations recorded automatically.

Install with npm install -g @fastly/mcp@2.1.1 or bunx -p @fastly/mcp@2.1.1 fastly-mcp.

Assets 2
Loading