v0.1.7

Fixes

• Mobile session creation no longer times out on real devices (#1, #2). Proxied appium-mcp calls were inheriting the MCP SDK's 60 s default request timeout, far below real-device provisioning (~200 s for a free iPhone; the hub itself only gives up at ~315 s). The client abandoned the request while the hub kept starting the session, so the agent never learned the session ID and could neither use nor delete it — and it billed until the hub reaped it.

  appium_session_management creates now get 600 s, other proxied calls 120 s, both with resetTimeoutOnProgress bounded by maxTotalTimeout. Configurable via TESTINGBOT_APPIUM_SESSION_TIMEOUT_MS and TESTINGBOT_APPIUM_TIMEOUT_MS.

Security

• All open Dependabot alerts cleared (#3) — npm audit goes from 20 vulnerabilities (14 moderate, 6 high) to 0: qs ^6.16.0, morgan ^1.12.1, @puppeteer/browsers ^3.2.2 (drops the unpatched extract-zip symlink path traversal), and vitest 4.1.11 for the dev-only @vitest/mocker path traversal.

Full changelog: v0.1.6...v0.1.7