Skip to content

v0.20.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 18:03
· 26 commits to main since this release
v0.20.1
0094208
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

Changed

  • ymcp is no longer published to winget, and no longer suggests updating through it; Homebrew, Scoop, the install scripts and Docker remain.

Fixed

  • Binaries are built with an updated golang.org/x/text, fixing two known vulnerabilities on crafted input.
  • A stray escape byte from a CI job log with broken UTF-8 no longer reaches the pipeline agent's prompt.

Changelog

Fixes

  • 0dc031e: fix: raise the OpenSSF Scorecard (x/text, token permissions, pinned images, fuzzing) (#39) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp.

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.20.1.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).

Contributors

xlsft
Assets 16
Loading