Skip to content

v0.42.0

Choose a tag to compare

View all tags
@musharna musharna released this 26 Jul 02:26
v0.42.0
0073a73
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.42.0

Highlights:

  • Streamable HTTP transport (--transport http) alongside stdio; mcp pinned to

    =1.28.1,<2 for 3 high-severity CVEs.

  • Four new sources: BioStudies (EBI/ArrayExpress), GBIF (biodiversity),
    data.gov (US federal open data), and NASA CMR (Earth science) — 13 -> 17.
  • Search now reports unresolved ontology params instead of silently dropping
    them, with capability-gated elicitation.

Security:

  • operate with op='sql' can no longer make the server fetch arbitrary URLs.
    httpfs stayed loaded after the local-filesystem lockdown, so a crafted SELECT
    made the server issue the request and return the body as rows — SSRF with
    response exfiltration under --transport http. Both filesystems are now
    disabled before the configuration is locked.

Fixes:

  • bioproject: resolve was 100% broken (wrong NCBI search field).
  • EuropePMC open-access full text was reported as paywalled (PMCID quoting).
  • uniprot: resolve/fetch were unreachable (missing dispatch entry).
  • OpenNeuro manifests, DANDI licences behind an spdx: prefix, and 4 advertised
    id_examples that did not resolve.

See CHANGELOG.md for the complete list.

Assets 2
Loading