Skip to content

1.0.5

Choose a tag to compare

View all tags
@cliffhall cliffhall released this 11 Nov 21:39
1.0.5
e1e5ffa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

v1.x security fixes

1.0.5 is a security release for the deprecated v1 line. Upgrade with npx @modelcontextprotocol/inspector@v1-latest, or move to v2 (@latest).

  • The proxy now refuses two more fixed cloud metadata addresses. Its connection guard already blocked 169.254.0.0/16. It now also blocks 100.100.100.200 (Alibaba Cloud ECS) and 192.0.0.192 (Oracle Cloud Classic), including their IPv4-mapped IPv6 forms. The surrounding 100.64.0.0/10 range stays reachable, so Tailscale and other CGNAT targets still work. (GHSA-fvg8-f358-w2c8)
  • v1: bump open to ^11 by @cliffhall in #2939
  • chore(release): bump version to 1.0.5 by @cliffhall in #2956

Thanks for helping us improve

This release addresses a vulnerability reported by a community member. Thank you for taking the time to report it responsibly:

Full Changelog: 1.0.4...1.0.5
Smoke test ledger: https://claude.ai/artifact/WdtpJb4Xp7MAeSL91Jzwv9

Contributors

cliffhall and uaminevrm
Assets 2
Loading