2.3.4 — RPC error sanitization

Released 2026-10-12.

• Require rpc-express-toolkit ^4.5.2 for default internal-error sanitization and corrected JSON-RPC envelope handling.
• Preserve intentional public application errors with an explicit integer code, public message, and safe data. Unexpected errors return -32603 / Internal error without internal details.
• Add four flow-backed HTTP error regressions covering standard and Safe Mode.
• Validation: 18 tests passed against the published dependency; all ten configured Node.js/Node-RED CI combinations plus package checks passed; runtime dependency audit reports no vulnerabilities.

The existing wire protocol and UI are unchanged. Flows that intentionally expose errors must follow the documented public-error contract.

node-red-contrib-rpc-toolkit 2.3.3

Highlights

• Packages all regular files as mode 0644; CI and prepublish checks now reject executable package files.
• Refreshes locked dependencies and raises the minimum rpc-express-toolkit version to 4.5.1.
• Updates release guidance to require packaging from a native Linux filesystem.

Validation: all 11 CI jobs passed across Node.js 18, 20, 22, and 24 with Node-RED 3, 4, and 5; 14/14 local tests passed; the production dependency audit found zero vulnerabilities. Five moderate advisories remain in the Node-RED development dependency tree and are outside this plugin's published runtime dependencies. The attached tarball is the validated artifact intended for npm publication.

node-red-contrib-rpc-toolkit 2.3.2

Patch release aligning the Node-RED package with rpc-express-toolkit@4.4.1.

Changes:

• Raised the minimum dependency range to rpc-express-toolkit@^4.4.1
• Updated the lockfile to resolve rpc-express-toolkit@4.4.1
• Refreshed locked runtime dependencies to security-patched body-parser@2.3.0 and fast-uri@3.1.4

Validation:

• Pull request and post-merge CI passed all 11 jobs
• Compatibility matrix passed across Node.js 18, 20, 22, and 24 with Node-RED 3, 4, and 5
• Local test suite passed: 14/14 tests
• Runtime audit found 0 vulnerabilities
• Package dry-run and clean tarball installation smoke test passed

NPM package: node-red-contrib-rpc-toolkit@2.3.2

node-red-contrib-rpc-toolkit 2.3.1

Patch release aligning the Node-RED package with rpc-express-toolkit@4.4.0.

Changes:

• Updated dependency range to rpc-express-toolkit@^4.4.0
• Lockfile now resolves rpc-express-toolkit@4.4.0 and reuses the top-level Express 5 runtime

Validation:

• npm test passed: 14/14 tests
• npm run audit:runtime found 0 runtime vulnerabilities
• npm run pack:check passed

NPM package: node-red-contrib-rpc-toolkit@2.3.1

node-red-contrib-rpc-toolkit 2.3.0

Release 2.3.0 adds bearer token authentication support and credential-backed token handling for Node-RED RPC flows.

Includes:

• rpc-server bearer token authentication
• server and client tokens stored in Node-RED credentials
• legacy flow fallback for previously exported client token fields
• improved rpc-server and rpc-client editor layout
• tabular rpc-server status display
• ready-to-import bearer auth loopback example

Validation:

• npm test: 14/14 passed
• npm run pack:check passed
• npm audit --omit=dev found 0 vulnerabilities

npm package: node-red-contrib-rpc-toolkit@2.3.0

node-red-contrib-rpc-toolkit 2.2.6

Documentation patch release.

Fixed:

• Replaced the broken dynamic Node-RED shields badge with a stable Flow Library badge.

Validation:

• npm test
• npm run audit:runtime
• npm run pack:check

node-red-contrib-rpc-toolkit 2.2.5

Documentation-focused release for the Node-RED Flow Library presentation.

Changes:

• Reworked the README opening and quick start for clearer onboarding.
• Clarified default Safe Mode behavior without making it look mandatory for generic JSON-RPC clients.
• Added clearer plain JSON-RPC and Safe Mode guidance.
• Documented BigInt marker handling as marker strings in Node-RED flows.

Validation:

• npm test
• npm run audit:runtime
• npm run pack:check

node-red-contrib-rpc-toolkit 2.2.4

Patch release for Node-RED Flow Library scorecard example coverage.

Includes:

• Added a ready-to-import rpc-request parser example.
• Updated README and examples catalog to include the request parser flow.
• Keeps every non-config package node covered by at least one example flow.

Validation:

• node-red-dev validate: examples found for all nodes.
• npm test: 8/8 passing.
• npm audit / audit:runtime: 0 vulnerabilities.
• npm outdated: no outdated dependencies.
• npm pack --dry-run: includes examples/request-parser-basic.json.

node-red-contrib-rpc-toolkit 2.2.3

Patch release for Node-RED RPC Toolkit usability and package metadata.

Includes:

• Ready-to-import example flows for standard JSON-RPC, Safe Mode, validation errors, client calls, client error output, and local loopback tests.
• README links to the grouped example flow catalog.
• npm repository metadata normalized.
• Express runtime dependency updated to 5.2.1 and verified with the existing test suite plus Docker runtime feature probe.

Validation:

• npm test: 8/8 passing.
• npm audit / audit:runtime: 0 vulnerabilities.
• npm outdated: no outdated dependencies.
• Docker Node-RED feature probe: 27/27 passing.

node-red-contrib-rpc-toolkit 2.2.2

Patch release focused on public package readiness and server usability.

Includes:

• Configurable RPC Toolkit Safe Mode on the rpc-server config node
• Standard JSON-RPC 2.0 server mode when Safe Mode is disabled
• Accurate server status UI for Safe Mode and CORS
• __rpc.capabilities validation and CORS reporting fixes
• Updated README with implemented behavior and Safe Mode notes
• Cleaner npm metadata and package contents allowlist
• CI for tests, runtime audit, and package content checks

Validation:

• npm test: 8/8 pass
• npm audit: 0 vulnerabilities
• npm audit --omit=dev: 0 vulnerabilities
• npm pack --dry-run: 18 public package files
• Docker Node-RED 4.1.0 interoperability probe: 23/23 pass