v0.4.4: Security dependency updates
Changes
- Updated the transitive YAML parser used for knowledge-base frontmatter to address a quadratic CPU-exhaustion denial-of-service vulnerability (GHSA-h67p-54hq-rp68, #254).
- Updated GitHub Actions and development tooling, including an enforced esbuild security override.
Install
npm publication is pending; @steipete/macos-automator-mcp@0.4.4 is not yet available from the registry. Use 0.4.3 until the package metadata below is populated.
Package and proof
- npm version: pending registry publication.
- Registry tarball: pending registry publication.
- Registry integrity: pending registry publication; exact value will be appended after verification.
- Publish time: pending registry publication; exact value will be appended after verification.
- Exact-head CI: https://github.com/steipete/macos-automator-mcp/actions/runs/28500967609
- Build and lint: https://github.com/steipete/macos-automator-mcp/actions/runs/28500967609/job/84477925894
- Knowledge-base validation: https://github.com/steipete/macos-automator-mcp/actions/runs/28500967609/job/84477975667
- macOS MCP stdio proof: https://github.com/steipete/macos-automator-mcp/actions/runs/28500967609/job/84477925931
- Full changelog: v0.4.3...v0.4.4