Skip to content

v0.6.3

Choose a tag to compare

View all tags
@jonnybottles jonnybottles released this 10 Jul 15:47
· 22 commits to main since this release
v0.6.3
1e97190

What's changed

  • Startup log no longer echoes MCP_TRUSTED_PROXIES values — it now reports Trusting X-Forwarded-For: via N pinned proxy entries (MCP_TRUSTED_PROXIES). Removes the value flow that tripped CodeQL's clear-text-logging heuristic on every refactor touching the line; behavior of XFF trust handling is unchanged (#10, #11)
  • New test pins the summarized line and asserts raw proxy values never appear in startup output
  • Docs: README/CLAUDE.md note that the startup log reports only the count of pinned proxies

Full Changelog: v0.6.2...v0.6.3

Assets 2
Loading