v1.14.0

What's New in v1.14.0

Changes

• chore(release): 1.14.0 (#478)
• chore(stats): refresh impact.json (collected 2026-10-05)
• docs: session log 2026-10-07 (hosted onboarding, telemetry gap)
• docs: record post-update CI on the dependabot PRs
• docs: executor results for 2026-10-08 brief
• triage: GitHub activity brief 2026-10-08
• fix(student): carry membership and announcement repairs into grade integration
• fix(student): retry unreadable announcement chunks independently
• fix(student): close sibling group reads and chunk retry gaps
• fix(student): carry reviewed SIS and activity diagnostics into groups integration
• fix(student): close SIS error leak and expose full-read item IDs
• fix(grades): reject non-numeric grade fields, duplicate IDs and unknown restriction state
• docs: list the student Inbox tools in the student guide
• fix(student): refuse blank subjects and unreadable reply conversation state
• fix(student): treat unreadable quiz attempt data as unknown state
• fix(student): restrict group file content types to short ASCII MIME tokens
• fix(student): anchor display allowlists and fence unknown notification categories
• docs: list the calendar and planner tools in the student guide
• fix(grades): fail closed on untrusted or unknown grade inputs
• fix(student): fail closed on unreadable reply conversation state
• fix(student): make the feed tools fail closed on untrusted input
• fix(student): fail closed on a blank group course filter and Canvas error bodies
• fix(student): make the quiz tools fail closed on unmatched and unexpected data
• fix: refuse calendar and planner writes when ownership or course is unknown
• refactor(core): make the shared course refresh state explicit for CodeQL
• docs: correct the READ section count comment in tool_policy
• docs: document the student group tools and update tool counts
• feat(student): read-only tools for the caller's own Canvas groups
• fix(anonymization): protect group discussion topics and keep group names
• docs: document the student Inbox tools and update tool counts
• feat(student): Inbox tools for students
• fix(privacy): anonymize /search/recipients at the free_text tier
• docs: document the student feed tools and update tool counts
• docs: document the student quiz tools and update tool counts
• docs: document the calendar and planner tools
• feat(student): add cross-course announcements and activity stream tools
• feat(student): add read-only list_quizzes and get_quiz_details
• feat: add student calendar and planner tools
• docs: document the student grade insight tools
• feat(student): add get_my_assignment_scores and calculate_grade_scenarios
• feat(grades): add pure Canvas grade arithmetic core
• fix(hooks): reject unchecked commits when Python is unavailable
• fix(deps): update multidict lock to patched 6.9.1
• docs: executor results for 2026-10-07 brief
• triage: add local verification and consolidated action list
• triage: note this PR's own CI red is the known multidict advisory
• triage: GitHub activity brief 2026-10-07
• test: keep the upload tests patching get_course_id
• docs: describe course identifier resolution
• fix(files): resolve the course through resolve_numeric_course_id
• fix(core): resolve course codes, names and SIS IDs from the course list
• docs: note that list_discussion_entries previews unless include_full_content is set
• chore: declare Python 3.14 in the package classifiers
• docs: describe complete full-content reads and the large-result declaration
• fix: return full-content reads whole and let clients accept large results
• docs: changelog entry for Windows support
• ci: test on Windows and Python 3.14
• test: make two subprocess tests independent of the Windows host
• fix(deps): install tzdata on Windows so TIMEZONE works
• test(dates): run the timezone conversion tests and fix their expected offset
• test: make the symlink and permission-bit tests portable to Windows
• fix(hooks): run the commit-msg checker with a Python that actually runs
• fix(audit): close audit handlers on reset instead of dropping them
• docs: executor results for 2026-10-06 brief
• triage: restore dropped high-sensitivity #441 finding
• triage: document new multidict CVE found by this PR's own CI
• triage: GitHub activity brief 2026-10-06
• docs: executor results for 2026-10-05 brief
• triage: GitHub activity brief 2026-10-05
• triage: cross-reference executor findings from top summary
• docs: executor results for 2026-10-04 brief
• triage: strip collaborator affiliation/competing-product mention
• triage: GitHub activity brief 2026-10-04
• Resolve literal import aliases in the text encoding guard
• Distinguish module open modes from path method modes
• Check text-mode os.fdopen in the encoding guard
• Name ignore_for_scoring precisely in rubric verification docs
• Describe response consistency without claiming persisted grade verification
• Remove stale internal discovery middleware count
• Sync remaining grading and discovery catalog details
• Address automated review of anonymous topic safeguards
• Clarify rubric grading safeguards and discovery documentation
• Refuse anonymous discussion updates before writing
• fix: preserve Canvas ordering and traverse deep reply chains iteratively
• fix: remove unreachable GraphQL node guard
• fix: report GraphQL metadata limits and refuse partial discussion reads
• test: pin utf-8 on every text read and write in the suite
• docs: executor results for 2026-10-03 brief
• fix: correct PR #441 line citations in the 2026-10-03 triage brief
• triage: GitHub activity brief 2026-10-03
• Correct deployment promotion and inbox truncation guidance (#443)
• fix: avoid reusing string entry id for optional Canvas ids
• test: use consistent client import style for CodeQL
• fix: preserve cached anonymous replies and normalize optional topic titles
• test: assert cached anonymous entry replies retain their content
• docs: session log 2026-09-30/10-01 (six PRs merged, CLAUDE.md trim, issue agents)
• docs: executor results for 2026-10-02 brief
• triage: GitHub activity brief 2026-10-02
• docs: describe the GraphQL read for anonymous topics (issue 421, part 2)
• Remember unservable topics for ten minutes to skip the REST 404
• Read anonymous discussions through GraphQL after the REST 404 (issue 421, part 2)
• Add a graphql API root to the client, anonymized fail-closed
• Guarded body edits: expect_updated_at, find/replace, require (#419) (#437)
• fix: disclose truncated reads; assign_peer_review never writes a placeholder (issue 420) (#436)
• Opt-in raw_dates block for assignment and discussion read tools (#418) (#438)
• test: pin the Canvas base URL in the anonymous-topic real-transport test
• fix(discussions): explain REST 404s for anonymous topics the list still shows (#435)
• Read discussions inside group spaces (group_id, list_group_discussion_topics) (#433)
• fix(deps): bump urllib3 2.7.0 -> 2.8.0 in uv.lock (3 advisories) (#434)
• docs: point coding agents from AGENTS.md to CLAUDE.md; date and fix reference claims
• chore(stats): refresh impact.json (collected 2026-09-28)
• chore(deps-dev): bump tsx from 4.23.13 to 4.23.15 (#428)
• fix: use Canvas's missing flag for overdue submissions (#423)
• chore(deps-dev): bump @types/node from 26.6.1 to 26.6.2 (#427)
• chore(deps): bump the actions group with 6 updates (#429)
• docs: trim CLAUDE.md from 497 to 77 lines; move history and how-tos to internal/
• docs: executor results for 2026-09-30 brief
• fix(deps): bump pyjwt 2.13.0 -> 2.15.1 in uv.lock (10 CVEs) (#432)
• docs: record merge status for the 2026-09-30 brief
• docs: executor results for 2026-09-30 brief
• triage: GitHub activity brief 2026-09-30
• docs: executor results for 2026-09-29 brief
• triage: GitHub activity brief 2026-09-29
• docs: session log 2026-09-27 (v1.13.0, GHSA-hmr8 fix, production pinned to releases)

---

Released: October 08, 2026

For installation instructions, see the README.

canvas-mcp.mcpb ships with SLSA build provenance.
Verify it with: gh attestation verify canvas-mcp.mcpb --repo vishalsachdev/canvas-mcp