Skip to content

v5.0.0 - Major Architecture Overhaul, Security Enhancements, & Dependency Modernization

Choose a tag to compare

View all tags
@neverinfamous neverinfamous released this 06 Jun 10:17
· 2 commits to main since this release
v5.0.0
85b3116

Release v5.0.0

Highlights

  • Stateful HTTP Sessions: Added HTTP stateful session enforcement with 30-minute idle timeout and in-flight request locks.
  • Security Hard Gates: Introduced strict fail-closures for isolated-vm native bindings and required ALLOWED_IO_ROOTS for HTTP transports to prevent misconfigurations.
  • Optimistic Concurrency Control (OCC): New tools in the core group (sqlite_enable_versioning, sqlite_disable_versioning, etc.) for managing concurrent access.
  • Native WASM Concurrency: Optimized WASM adapter request serialization via a robust reader-writer lock mechanism.
  • Expanded Test Coverage: Reached >90% overall project coverage with new comprehensive vitest suites spanning vector schemas, SpatiaLite loaders, and system databases.

Added

  • Contextual README.md files to core directories (.agents, .github, config, extensions, scripts, src, tests).
  • TimeoutError, RateLimitError, and ConflictError typed error classes.
  • stream: true and chunkSize parameters to sqlite_read_query.
  • Automatic snake_case to camelCase parameter mapping in validation schemas and the Code Mode V8 proxy.
  • Test scripts verify-schemas.mjs, test-zod-errors.mjs, and test-tool-annotations.mjs.

Changed

  • Deprecated worker Code Mode isolation options in .env.example.
  • Updated default CODE_MODE_MAX_RESULT_SIZE limit documentation to match 10MB runtime default.
  • Bumped isolated-vm to 7.0.0 for Node.js 26 compatibility and migrated package manager to pnpm.
  • Surfaced Code Mode errors as structured typed errors and returned structured JSON for HTTP rate limit responses.
  • sqlite_write_query and sqlite_upsert now require an expectedVersion parameter for version-enabled tables.
  • Split complex tool handlers into sub-modules and grouped exports via barrel files.
  • Optimized error serialization overhead, ReadWriteLock concurrency, and Code Mode AST parsing caching.

Fixed

  • Cleaned up orphaned SQLite Write-Ahead Log (-wal) and Shared Memory (-shm) files during test environment resets.
  • Fixed sqlite_read_query graceful degradation to full buffering in Code Mode when stream: true is requested.
  • Added missing PROJECT_REGISTRY and TEAM_DB_PATH variables in configuration examples.
  • Code Mode sandbox timeouts now correctly throw TimeoutError.
  • Prevented native addon crashes during Vitest by changing the execution pool from threads to forks.
  • Removed unused zod-to-json-schema dependency and rimraf devDependency.
  • Resolved false-positive Promise rejections and case-insensitive operation parsing.

Security

  • Hard Gate: Code Mode strictly fail-closes if isolated-vm native bindings fail to load.
  • Hard Gate: HTTP transports fail to start if ALLOWED_IO_ROOTS is omitted.
  • Stdio transport defaults to no filesystem access if omitted.
  • Hardened all filesystem-touching tools to use symlink-aware realpath resolution.
  • Sessions exceeding timeout limits are automatically expired and cleaned up.

Compare changes

Install via Docker

docker pull writenotenow/db-mcp:v5.0.0
Assets 2
Loading