Skip to content

v1.1.3

Choose a tag to compare

View all tags
@jochen-testingbot jochen-testingbot released this 16 Sep 12:25
· 8 commits to main since this release
v1.1.3
2fb2007

Fixes

  • Mobile session creation no longer times out on real devices. Bundles @testingbot/automation-mcp 0.1.7, which stops proxied appium-mcp calls inheriting the MCP SDK's 60 s default request timeout — far below real-device provisioning (~200 s for a free iPhone; the hub gives up at ~315 s). Previously appium_session_management action=create returned Request timed out while the hub kept starting the session, so the session could be neither used nor deleted and billed until the hub reaped it.

    Creates now get 600 s and other proxied calls 120 s, tunable via TESTINGBOT_APPIUM_SESSION_TIMEOUT_MS and TESTINGBOT_APPIUM_TIMEOUT_MS. See testingbot/automation-mcp#1.

Security

  • All open Dependabot alerts cleared (#1) — npm audit reports 0 vulnerabilities: qs ^6.16.0, morgan ^1.12.1, @puppeteer/browsers ^3.2.2, and vitest 4.1.11 for the dev-only @vitest/mocker path traversal.

    This reverses the v1.1.2 decision to stay on @puppeteer/browsers 2.x: v3 drops the unpatched extract-zip symlink path traversal (both high alerts) but declares engines: node >=22.12.0. That field is advisory — webdriver, @wdio/utils, and @puppeteer/browsers v3 were all verified importing cleanly on Node 20.20.2, and the browser-download paths that engine bound protects are never invoked against a remote hub. Note that the .mcpb bundle carries v3, since npm overrides apply when the bundle's runtime tree is installed; consumers installing from npm resolve v2 as before, because overrides don't propagate to dependents.

Full changelog: v1.1.2...v1.1.3

Assets 3
Loading