v0.3.0

Added

• Dockerfile (multi-stage, non-root, stdio entrypoint) and .dockerignore,
  so registries that build and introspect the server in a container no longer
  have to guess a build.
• Multi-arch container images (linux/amd64, linux/arm64) published to
  ghcr.io/ni-c/wg-easy-mcp with an SBOM and build provenance. server.json
  now lists the OCI package alongside the npm one.
• Documentation site at wg-easy-mcp.ni-c.de:
  guide, per-tool reference, environment variables and changelog.
• CI additions: CodeQL, a Trivy scan of the image on both architectures, and
  the GHCR publish job. main now requires all of them.
• CONTRIBUTING.md, issue forms and GitHub Discussions.

Changed

• Missing WG_EASY_URL/WG_EASY_USERNAME/WG_EASY_PASSWORD no longer exit at
  startup. The server completes the MCP handshake and lists its tools without
  credentials; they are required when a tool actually calls the API, which then
  fails with the same setup instructions as before. URL validation still exits,
  since a bad URL can leak the credentials.
• Payloads returned by the wg-easy API now carry an explicit untrusted-data
  marker and are capped at 60 000 characters, with the truncation notice naming
  the call that fetches the rest. Client names, DNS entries and endpoints are
  free-form strings, so they are marked as data rather than instructions.
  Server-composed messages, including the delete confirmation, stay unmarked.
• The runtime image no longer contains npm. The entrypoint is plain node, and
  npm's vendored dependency tree was the sole source of the container scan's
  HIGH/CRITICAL findings.
• typescript 6.0.3, typescript-eslint 8.67.0.

Security

• WG_EASY_URL containing embedded credentials (user:password@host) is now
  rejected at startup. They bypassed the environment wipe in loadConfig, were
  prefixed onto every request path and were echoed verbatim in the startup log.

v0.2.2

Added

• Listed in the official MCP Registry
  as io.github.ni-c/wg-easy-mcp; the release workflow publishes registry
  updates automatically via GitHub OIDC (server.json, mcpName field).
• npm provenance attestations for published packages.
• CodeQL default setup scanning.

Changed

• The repository is now public.
• Dependency majors: zod 4 (first release including it; vitest 4 and
  eslint 10 in the dev toolchain).

v0.2.1

Added

• Release workflow: pushing a v* tag runs the test suite, publishes to npm
  via trusted publishing (OIDC, no token) and creates a GitHub release from
  the changelog entry.
• CI: weekly scheduled runs, npm audit job (fails on high/critical),
  coverage reporting with thresholds on the Node 24 run.
• Dependabot updates for npm dependencies (minor/patch grouped) and pinned
  GitHub Actions.
• Tests for the configuration loader (URL validation, credential cleanup,
  plain-http warning).