Skip to content

v2.2.1

Choose a tag to compare

View all tags
@lazyants lazyants released this 20 Jun 11:47
· 16 commits to main since this release
v2.2.1
e9ba1a2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch — clears two HIGH npm-audit advisories that were failing the npm audit --audit-level=moderate --omit=dev CI gate:

  • form-data (GHSA-hmw2-7cc7-3qxx) — CRLF injection via unescaped multipart field/file names; reaches the prod tree via axios. Pinned ^4.0.6 (lockfile resolves 4.0.6).
  • hono (<= 4.12.24) — serve-static path traversal et al.; reaches prod via @modelcontextprotocol/sdk → @hono/node-server. Override ^4.12.25.

Dependency-only change — no runtime or API behaviour changes. See CHANGELOG.md for full details.

Assets 2
Loading