v1.0.0

Toolchain image

ghcr.io/mazze93/github-mcp-gateway-toolchain:v1.0.0

Digest: sha256:d4f70d345e68fea6e56035a4a6a5cddfec95f4a6d927a57c22e800239fbd5085
Platforms: linux/amd64,linux/arm64

Signed keyless with cosign, published with an SBOM and SLSA
provenance attestation. Verify:

cosign verify ghcr.io/mazze93/github-mcp-gateway-toolchain:v1.0.0 \
  --certificate-identity-regexp '^https://github.com/mazze93/github-mcp-gateway/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

This image builds and deploys the Worker — it does not run the
gateway. The gateway is live at
https://github-mcp-gateway.mazzewhiteley93.workers.dev/mcp and ships
via deploy.yml on merge to main.

What's Changed

• Bump fast-uri from 3.1.3 to 3.1.4 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1
• Bump sharp from 0.34.5 to 0.35.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #2
• Add AGENTS.md for cross-tool agent context by @mazze93 in #3
• Add dev launch config and global_fetch_strictly_public compat flag by @mazze93 in #4
• fix(deps): clear the agents/@hono/node-server advisory chain (9 → 3) by @mazze93 in #5
• ci: add build/typecheck/audit gate, CodeQL, and Dependabot by @mazze93 in #6
• ci: deploy to Cloudflare on merge to main, with a post-deploy smoke test by @mazze93 in #11
• deps-dev: bump typescript from 5.9.3 to 7.0.2 by @dependabot[bot] in #10
• deps: bump octokit from 4.1.4 to 5.0.5 by @dependabot[bot] in #9
• deps: bump zod from 3.25.76 to 4.4.3 by @dependabot[bot] in #8
• deps: bump the production-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #7
• Bump wrangler to 4.119.0, override undici to 7.29.0 by @mazze93 in #12
• Add a Vitest test suite for the OAuth/token/tool-error paths by @mazze93 in #13
• Test suite by @mazze93 in #14
• ci: deploy to Cloudflare on merge to main, with a post-deploy smoke test by @mazze93 in #17
• Test suite by @mazze93 in #18
• ci: Bump the actions group with 2 updates by @dependabot[bot] in #22
• deps: Bump @cloudflare/workers-oauth-provider from 0.8.3 to 0.10.0 in the production-dependencies group by @dependabot[bot] in #21
• deps-dev: Bump @cloudflare/workers-types from 5.20260801.1 to 5.20260804.1 in the dev-dependencies group across 1 directory by @dependabot[bot] in #20
• docs: correct CLAUDE.md deploy path; fix(deps): clear nanoid from the production audit gate by @mazze93 in #25
• deps: bump the production-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #24
• deps-dev: bump the dev-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #23
• fix(oauth): stop dropping the approved-clients cookie on consent; cover the /authorize routes by @mazze93 in #26
• build: tag-triggered semver release publishing a hardened toolchain image by @mazze93 in #27
• fix(ci): deploy.yml was structurally invalid and had never once run by @mazze93 in #29

New Contributors

• @dependabot[bot] made their first contribution in #1
• @mazze93 made their first contribution in #3

Full Changelog: https://github.com/mazze93/github-mcp-gateway/commits/v1.0.0