v1.0.31

Summary

This release brings the OAuth consent screen into the React dashboard as a full SPA experience, showing the resource being requested and the client metadata so users can make informed approval decisions. It also ships security and reliability fixes: stricter full-containment enforcement for scoped bearer keys on group routes (GHSA-454m-4vm6-842f), a fix for per-request abort-signal listener leaks in MCP, header parameters exposed in the generated MCP input schema, BASE_PATH support for local development, and clearer database configuration documentation.

Features

• Render OAuth consent screen inside the React dashboard (SPA) by @samanhappy in #1060
• Surface resource target and client metadata on consent screen by @samanhappy in #1061

Fixes

• Expose header parameters in generated MCP input schema by @11113127 in #1058
• Require full containment for scoped bearer keys on group routes (GHSA-454m-4vm6-842f) by @samanhappy in #1059
• Isolate per-request abort signals to prevent listener leak by @samanhappy in #1062
• Clarify database configuration source of truth by @samanhappy in #1063
• Support BASE_PATH in local development by @samanhappy in #1064

摘要

本版本将 OAuth 授权确认页以完整的 SPA 形式整合进 React 控制台，清晰展示被请求的资源与客户端元数据，帮助用户做出更明智的授权决定。同时修复了安全与可靠性问题：对组路由上的作用域 bearer 密钥强制要求完全包含（GHSA-454m-4vm6-842f）、修复了 MCP 中按请求隔离的 abort 信号导致的监听器泄漏、在生成的 MCP 输入 schema 中暴露 header 参数、本地开发支持 BASE_PATH，并澄清了数据库配置的权威来源。

功能

• 在 React 控制台内渲染 OAuth 授权确认页（SPA）by @samanhappy in #1060
• 在授权确认页展示资源目标与客户端元数据 by @samanhappy in #1061

修复

• 在生成的 MCP 输入 schema 中暴露 header 参数 by @11113127 in #1058
• 要求组路由上的作用域 bearer 密钥完全包含（GHSA-454m-4vm6-842f）by @samanhappy in #1059
• 隔离按请求的 abort 信号以防止监听器泄漏 by @samanhappy in #1062
• 澄清数据库配置的权威来源 by @samanhappy in #1063
• 本地开发支持 BASE_PATH by @samanhappy in #1064

New Contributors

• @11113127 made their first contribution in #1058

References

• fix(openapi): expose header parameters in generated MCP input schema by @11113127 in #1058
• fix(security): require full containment for scoped bearer keys on group routes (GHSA-454m-4vm6-842f) by @samanhappy in #1059
• feat(oauth): render consent screen inside the React dashboard (SPA) by @samanhappy in #1060
• feat(oauth): surface resource target and client metadata on consent screen by @samanhappy in #1061
• fix(mcp): isolate per-request abort signals to prevent listener leak by @samanhappy in #1062
• docs: clarify database configuration source of truth by @samanhappy in #1063
• fix: support BASE_PATH in local development by @samanhappy in #1064
• Full changelog: v1.0.30...v1.0.31