Repository navigation
Releases
Releases · Grey-Iris/easy-notion-mcp
v1.1.0
What's Changed
- ci: add version-stable ci-required aggregator gate by @misterwigglesworth in #73
- docs(recipes): make Recipe 1 dedupe deterministic and re-run-safe by @misterwigglesworth in #72
- feat(cli): one-command bootstrap wizard — Phase 1 (Claude Code) by @misterwigglesworth in #74
- chore(deps): bump transitive fast-uri to 3.1.4 (two host-confusion advisories) by @misterwigglesworth in #79
- feat(tools): accept page_id as documented alias for database_id (#71) by @Gameraboy in #76
- fix: null guards for five undefined-arg crash paths (issue #69) by @misterwigglesworth in #75
- feat(markdown): add opt-in collapse_soft_wraps to markdown-writing tools by @NightShadow09 in #78
- chore(deps): bump transitive ip-address to 10.4.0 (three SSRF/trust-boundary advisories) by @misterwigglesworth in #81
- feat(tools): name the workspace root in errors, add get_config by @NightShadow09 in #80
- docs: make tool receipts, round-trip claims, and mention syntax truthful by @NightShadow09 in #82
- fix(client): scope Notion ID normalization to real UUID forms by @misterwigglesworth in #83
- feat(create): add strip_leading_h1 to the two creation tools by @NightShadow09 in #84
- feat(list_pages): return created_time and last_edited_time per row by @NightShadow09 in #85
- feat(receipts): add return_block_map to the six block_map tools by @NightShadow09 in #86
New Contributors
- @Gameraboy made their first contribution in #76
- @NightShadow09 made their first contribution in #78
Full Changelog: v1.0.1...v1.1.0
Contributors
misterwigglesworth, NightShadow09, and Gameraboy
Assets 2
v1.0.1
[1.0.1] - 2026-06-25
Security
- Production transitive dependency vulnerabilities cleared. Pinned patched
hono(^4.12.27) andqs(^6.15.3) viapackage.jsonoverridesto
resolve 6 production transitive vulnerabilities: 1 high in the hono chain
(pulled through@modelcontextprotocol/sdkand@hono/node-server) and 5
moderate in the qs / body-parser chain (pulled through express). All
advisories were already fixed and published upstream, so a registry-version
override was sufficient, with no SDK downgrade and nonpm audit fix --force.
npm audit --omit=devnow reports 0 vulnerabilities. - The vulnerabilities were confined to the experimental HTTP/OAuth transport;
the stdio path was unaffected. The HTTP/OAuth transport behavior is unchanged
and remains covered by the existing integration suite. - Upstream tracking issues against
@modelcontextprotocol/sdkcover raising the
bundled dependency floor (#2036, #2042, #1924). Remainingnpm auditfindings
are limited to development-only tooling (vite,form-data,esbuild) and
do not affect the published package.
Full Changelog: v1.0.0...v1.0.1
v1.0.0
v0.10.1
Security
Fixes an OAuth refresh-token-replay vulnerability in HTTP OAuth mode. The access-token verification path (verifyAccessToken) accepted a refresh token presented as a /mcp bearer, and since refresh tokens carried no expiry, a refresh token could be used as a non-expiring access bearer. Token records are now typed (access vs refresh) and only access tokens pass the bearer check.
Action required: existing OAuth sessions are invalidated by this change and clients re-authenticate once. Static-token (stdio) deployments are unaffected. HTTP OAuth mode is currently experimental.
No changes to the markdown tool surface.
Full Changelog: v0.10.0...v0.10.1
v0.10.0
What's Changed
- Release v0.9.0 by @misterwigglesworth in #62
- Release v0.9.1 by @misterwigglesworth in #63
- Release v0.9.2 by @misterwigglesworth in #64
- Release v0.9.3 by @misterwigglesworth in #65
- Release v0.9.4: honest token claim, product fixes, dependency-vuln assessment by @misterwigglesworth in #68
Full Changelog: v0.9.0...v0.10.0
Contributors
misterwigglesworth
Assets 2
v0.9.4
Contributors
misterwigglesworth
Assets 2
v0.9.3
Contributors
misterwigglesworth
Assets 2
v0.9.2
v0.9.1
Contributors
misterwigglesworth
