Skip to content

v2.19.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Oct 10:31
· 18 commits to main since this release
v2.19.1
58b03f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch Changes

  • #262 7126efe Thanks @tufantunc! - A reader refused read-only because its command carries a shell metacharacter now says so (#224). The refusal used to name only the profile ("Clear readOnly on the profile"), so sftp-list on a path like /srv/backup(old) read as a profile problem; it now names the character, and for sftp-list and sftp-download says the character is in the remote path. Nothing is refused or allowed that was not before.

  • #266 2446c3e Thanks @dependabot! - Require @modelcontextprotocol/sdk ^1.31.0 (was ^1.30.0), so an install can no longer keep an SDK affected by GHSA-6qxp-vccf-f47h (the SDK's OAuth client could send credentials to an authorization server the MCP server chose). That SDK also brings proxy-addr 2.0.8, past GHSA-jqcg-44mw-7w3h. Neither is reachable through this server — it uses neither the SDK's OAuth client nor express's proxy trust, and its HTTP transport resolves client addresses itself — but a dependency scanner reports both against any install that still resolves the older versions.

Assets 4
Loading