[5.0.1] — 2026-09-05
Patch release: dependency security updates and refreshed security policy documentation.
Security
- npm transitive dependency updates —
fast-uri3.1.5 → 3.1.7 (high: SSRF/host-confusion in URI parsing, via@modelcontextprotocol/sdk→ajv),qs6.15.3 → 6.16.0 (moderate: DoS / array-limit bypass, via MCP SDK →express),@humanfs/node0.16.7 → 0.16.8 (moderate: dev-only ESLint dependency). Outbound tool HTTP fetches use custom IP-pinned fetch logic, notfast-uri; the server uses stdio transport only (Express is not started). Updates reduce supply-chain exposure in published npm/Docker artifacts. SECURITY.mdrefreshed — Documents 5.0.x support, DNS rebinding mitigation (4.8.0), and credential redaction controls.