MT5-Quant v1.29.1

Bug fix release:

• Fix tools/list response format to wrap array in {tools: [...]} per MCP spec
  This resolves "cannot unmarshal array into Go value of type mcp.ListToolsResult"

SHA256: dd0b3bd342af8d72c94bdd1909737f449617f8ae32952e274085576f728ad741

MT5-Quant v1.29.0

MCP compliance fixes:

• Proper handling of notifications/initialized (no response for notifications)
• Dynamic version using CARGO_PKG_VERSION
• Skip serializing None fields in JSON responses

SHA256: 5d56099e01c6df0c16bc8aa28fffab2e3ba7502f283c3c8273b70e4192230f01

v1.28.0 — Security: path traversal fix

Security Fix

Patches two path traversal vulnerabilities in the new utility tools added in v1.27.0:

• export_report: user-supplied output_path was written without boundary validation
• create_set_template: same issue with user-supplied output_path

Both are now validated against the allowed base directory via a safe_output_path() helper that canonicalizes the parent directory and asserts the resolved path stays within bounds.

Upgrade recommended

All users of v1.27.0 should upgrade to v1.28.0.