v0.23.1

Maintenance release cut from v0.23.0. It contains exactly two fixes — a security patch and a dependency compatibility pin — and none of the ongoing v0.24.0 development on main.

🔒 Security

• SSE transport authentication boundary (GHSA-5j8j-256g-vvp5): the /sse and /messages endpoints of --transport sse now enforce the same per-request authentication as the streamable-HTTP transport. Full details in the security advisory published alongside this release. Upgrading is strongly recommended for anyone running the SSE transport.

🐛 Fixed

Confluence

• Pin atlassian-python-api below v5 (#1585, #1589): atlassian-python-api 5.0 removed core Confluence Cloud methods (get_page_by_id, create_page, update_page), so fresh installs that resolved the new major failed with AttributeError on basic page operations. The dependency is now bounded to >=4.0.0,<5.0.0 and a regression test guards the contract. Thanks @breezeFur for the fix and @mihnatova for the detailed report.

Contributors

Thanks to @breezeFur for the dependency fix and @mihnatova for the report that pinpointed #1585.

Full Changelog: v0.23.0...v0.23.1