Skip to content

v2.20.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 21:04
· 13 commits to main since this release
v2.20.1
5c5b847
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch Changes

  • #275 d47a335 Thanks @dependabot! - Allow @napi-rs/keyring 2 (^2.1.1, was ^1.1.0) for auth = "keychain" profiles. Its one breaking change is how a store failure is reported: a locked or inaccessible keychain used to read as "no entry" and now raises an error. This server already caught that error, so the outcome is the same — the lookup fails and the remaining credential sources are tried — except that the failure is now logged (Keychain lookup failed …) instead of passing silently.

  • #274 6fd0f53 Thanks @dependabot! - Require @modelcontextprotocol/sdk ^1.32.1 (was ^1.31.0), so an install can no longer keep an SDK affected by GHSA-46jr-4wx8-v453 (one HTTP request could exhaust server memory while it was validated). Over this server's HTTP transport that request is only accepted after the bearer token check, and the body is capped at 1 MiB, so it takes a token holder to send it. The same SDK release also fixes GHSA-rvq5-wwqv-78pq, GHSA-22jm-h49p-29qw and GHSA-6prh-2h8m-c8cw, none of which this server reaches: it checks its own bearer token rather than using the SDK's requireBearerAuth(), passes no taskStore, and uses no SDK client transport. A dependency scanner still reports all four against any install that resolves an older SDK.

Assets 4
Loading