Repository navigation
v1.1.1
Security and test-reliability maintenance patch. Preparing source artifacts does not authorize a GitHub Release or npm publication; those remain separate explicitly approved steps.
Security and compatibility
- Eliminated the currently reported lockfile dependency advisories by narrowly overriding affected
brace-expansion,@grpc/grpc-js, andsource-map-jsresolutions, and updated the development-only MCP client SDK to a patched version. The published MCP server peer floor remains^2.0.0. - Isolated the Cloudflare local workerd integration CI state from prior runs so retained test budgets cannot falsely deny a fresh conformance scenario.
- No accounting lifecycle, persisted Store schema, published runtime dependency, or public API semantics were intentionally changed. Release validation and authorization are separate steps (#246).
The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.