Skip to content

v1.12.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 06:29
· 13 commits to main since this release
v1.12.2
463341e

Security

  • Approving a connection requires the vault's client secret
    (GHSA-75v9-hg2f-5g9v,
    critical). Since 1.3.0 an MCP client could register itself and the
    consent screen issued a code to whoever pressed Authorize; a
    self-registered client then exchanged it without a secret. Anyone who
    could reach a server with AUTH_ENABLED=true could therefore mint a
    token with full read, write and delete access to the vault. For a
    self-registered client the consent screen now asks for
    VELLUM_CLIENT_SECRET and issues no code without it. The configured
    vellum client, which presents the secret at /token, keeps its
    one-click consent. The page can no longer be framed by another site.

    Upgrading restarts the server, which drops every token issued so far.
    If your server was reachable from the internet, also look through the
    vault for changes you did not make.

  • golang.org/x/text 0.37.0 → 0.39.0 (GO-2026-5970, an infinite loop on
    invalid input). The image is rebuilt with the current Go 1.26 toolchain,
    which carries the standard library fixes released since 1.12.1.

Assets 2
Loading