v0.15.1

What's new

Added

• Every release is published to the MCP Registry, which lists the Docker image as a stdio server configured by YOUTRACK_* variables.

Fixed

• Binaries are built with Go 1.26.10, fixing known vulnerabilities in the standard library (net/http, crypto/tls and others) that earlier builds shipped.

Changelog

Fixes

• 4bf5a3b: fix(build): build with Go 1.26.10 (#17) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp · winget: winget install xlsft.ymcp (once Microsoft merges the package).

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.15.1.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).