Skip to content

MCP v1.4.18 — dependency security maintenance

Latest
Latest

Choose a tag to compare

View all tags
@WeAreLocalFalcon WeAreLocalFalcon released this 06 Oct 20:56
v1.4.18
4ca6831
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Dependency-security maintenance release.

  • Update @modelcontextprotocol/sdk to 1.31.0 and resolve patched proxy-addr, fast-uri, Hono, ip-address, and source-map-js versions.
  • Remove vite-plugin-singlefile and its vulnerable micromatch/braces chain. A small local JS/CSS inliner preserves the exact default behavior used by this widget and upstream MIT attribution.
  • Production UI is byte-identical to the baseline built with the original plugin after compatible security updates.

Validation: clean install, 170 passing Bun tests, strict TypeScript, server/UI builds, deterministic artifacts, 57/60 discovery, current aliases/CSP/annotations, zero completed-report resource reads, dense 21x21 fixture, Skill compliance, and MCPB validation. Full and runtime npm audits report zero vulnerabilities; GitHub reports zero open Dependabot alerts.

Production deployment verified at commit 4ca6831. Widget primary URI remains v1.4.17 with the v1.4.16 compatibility alias. Skills, runtime application source, and the prepared Plugin ZIP are unchanged. This release does not indicate OpenAI approval.

Assets 3
Loading