Skip to content

v0.225.2 — 2026-06-15 — Apollo · Gordon

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Jun 05:12
· 110 commits to main since this release
v0.225.2
6944394

Security

  • Fixed legacy HTTP MCP transport Origin validation for the browser-to-localhost boundary. The legacy stateless HTTP transport now shares the same Origin policy as Streamable HTTP and rejects non-loopback browser origins before routing. Reported privately by Ryan Vonbrubeck (@dodge1218).
  • Advisory: GHSA-v3f4-w7r7-v3hm.

Full Changelog: v0.225.1...v0.225.2

Assets 2
Loading