Skip to content

v2.2.0 — Spec-Driven Audit Remediation

Choose a tag to compare

View all tags
@kunwarVivek kunwarVivek released this 08 Sep 14:29
· 16 commits to main since this release
v2.2.0
6aaef19

What's Changed

Security Hardening

  • CORS origin allowlisting — replaces wildcard * with env-configured WEBHOOK_ALLOWED_ORIGINS
  • Request body size limit (1MB) + Content-Type validation on webhook endpoint
  • Security response headers (X-Content-Type-Options, X-Frame-Options) on all responses
  • Per-IP webhook rate limiting (configurable via WEBHOOK_RATE_LIMIT/WEBHOOK_RATE_WINDOW_MS)
  • Webhook idempotency via X-GitHub-Delivery header deduplication
  • InputSanitizer expanded to all 21 AI entry points (was 4)

New Features

  • SecurityAuditLog — structured security event tracking with typed events, bounded buffer, per-type counters
  • ToolTelemetry — per-tool latency histograms and error counters, exposed in health_check
  • AI degradation indicators in discover_tools response — clients can see provider availability
  • IssueTriagingService fully implemented — triageAllIssues with batch processing, triaged label convergence, audit comments on autoApply
  • AgentMetricsService 5-min TTL cache — eliminates repeated 30s+ API scans

Fixes

  • resource-schemas.ts aligned with domain entity interfaces (removed phantom fields)
  • architecture.md corrected — services return plain interfaces, not domain entities
  • Vitest coverage thresholds enforced (55/45/57/54)
  • AGENTS.md duplicate Beads block removed
  • noNonNullAssertion in examples fixed
  • bin field corrected for npm CLI usage

Verification

  • tsc: 0 errors
  • 2,992 unit tests pass, 137 E2E tests pass
  • Coverage thresholds enforced and passing

Full Changelog: v2.1.0...v2.2.0
npm: npm install mcp-github-project-manager@2.2.0

Assets 2
Loading