v1.7.0

Changelog

• 09a5379 Add gitleaks config to allowlist README documentation examples
• cc39d67 Add security scanning and dependency automation
• 80b4a2c Bump CodeQL action v3 → v4
• e8d6aa5 Bump actions/checkout from 6 to 7
• 0968385 Bump deps to fix 2 Trivy CVEs
• a75c8b1 Bump deps to fix 4 govulncheck vulnerabilities
• 8b8673a Bump google.golang.org/api from 0.283.0 to 0.286.0
• b46a25d Create security.yml
• 5214490 Fix CI auth issues: remove duplicate checkout calls
• 1efedda Fix rate limiter IP extraction and TokenInfo data race
• 7a90155 Fix staticcheck deprecation warning: validate JSON before CredentialsFromJSON
• 3ef8424 Force Node.js 24 for GitHub Actions in security workflow
• b3a3f8d Harden auth based on security review findings
• 6777b5f Merge branch 'main' into dependabot/github_actions/actions/checkout-7
• 310cc67 Merge pull request #59 from paolobietolini/dependabot/github_actions/actions/checkout-7
• 8711cd0 Merge pull request #60 from paolobietolini/dependabot/go_modules/google.golang.org/api-0.286.0
• 3acf2e2 Replace deprecated CredentialsFromJSON with JWTConfigFromJSON
• 239a9c9 Restore checkout with repo-checkout: false for govulncheck
• 5ff2b68 Update dependencies and GitHub Actions from dependabot PRs
• acb4414 Update release.yml
• 1c21970 Update release.yml
• f5dbf52 Update security.yml
• 28ba4bd Update security.yml
• 1ccb691 Update security.yml
• 36ceebb Update security.yml
• 8113c6d Update security.yml
• 2fc9046 docs(skill): add configuration standards section
• a7186de feat(gtm): add best_practices_review and plan_safe_edit prompts
• 81c7795 feat(gtm): add embedded best-practices rule docs
• b3d34f7 feat(gtm): serve best-practices docs as MCP resources
• 8d47004 feat: add llms.txt endpoint and Claude Code skill for MCP consumers
• 9a4bda2 fix(auth): isolate OAuth users from service account credentials
• fbcd96d fix(gtm): commit best-practices docs excluded by *.md gitignore
• aae1108 fix: 9 bugs found via code audit

v1.6.0

Changelog

• 3602f27 Add update_account and update_container tools
• df32d3c Bump version to 1.5.9
• 5ce1bdc feat: OAuth-authenticated users also use SA token source when S2S configured
• d90a569 feat: add S2S API key branch to auth middleware
• 41752d5 feat: add service account config fields
• a97f85d feat: add service account token source and context helpers
• 0f2003c feat: getClient checks SA token source before OAuth token
• 4aa3d37 feat: wire service account S2S mode at startup
• 60e0375 fix: set ExpiresAt on SA TokenInfo to avoid zero-value expiry
• bb3611a release: bump to v1.6.0 — S2S service account auth

v1.5.8

Changelog

• 38a50e3 Bump version to 1.5.8
• 7ff5f9d OAuth callback: show success page with button for custom-scheme URIs (v1.5.8)

v1.5.7

Changelog

• 4285700 Bump version to 1.5.7
• 482dddd Serve HTML success page for custom-scheme OAuth redirects (cursor://, vscode://)

v1.5.6

Changelog

• 6094286 Bump version to 1.5.6
• 0a5e0b6 Revert OAuth callback to plain 302 redirect (RFC 8252)

v1.5.5

Changelog

• e037cda Bump version to 1.5.5
• ef6e994 Fix OAuth callback redirect for custom-scheme clients (Cursor, VS Code)

v1.5.4

Changelog

• 7dfd80d Bump version to 1.5.4
• b45e9ec Show success page after OAuth callback instead of bare redirect (v1.5.4)

v1.5.3

Changelog

• e466084 Bump version to 1.5.3
• 8c72d86 Remap autoEventFilter to filter for linkClick/click/formSubmission triggers (v1.5.3)

v1.5.2

Changelog

• 9192adc Include parameter array in tag and variable responses (v1.5.2)

v1.5.1

Changelog

• bfa8a14 Fix autoEventFilter silently ignored for linkClick/formSubmission/click triggers