v2.3.27

Changes in v2.3.27

🔒 Security

• Compact-result replay commands (GITLAB_MCP_COMPACT_RESULTS) now quote argument values safely for a POSIX shell, and omit the command when an argument cannot be written safely. Affects >= 2.1.69, <= 2.3.26. GHSA-mfp5-5gv8-2ph2
• excluded_file_patterns is evaluated with a linear-time (RE2) regex engine, with at most 50 patterns of 200 characters each. Patterns RE2 cannot compile (lookaround, backreferences) are skipped with a warning. Affects >= 1.0.60, <= 2.3.26. GHSA-wgqr-h4c5-gw82
• Bump the transitive hono dependency to 4.13.18 (#1038) for GHSA-4m76-xfj5-7975, GHSA-h7mg-cq63-vhpq, and GHSA-3gg2-335m-rxc6; @hono/node-server is bumped to 2.1.8 (#1036, #1037).

📝 Documentation

• docs(changelog): correct compact replay command notes #1048

🔨 Chore

• chore(deps): bump @hono/node-server from 2.1.5 to 2.1.8 in /mcp-server in the npm_and_yarn group across 1 directory #1036
• chore(deps): bump @hono/node-server from 2.1.5 to 2.1.8 #1037
• chore(deps): bump hono from 4.13.11 to 4.13.18 #1038

Other Changes

• Add project logo to README, docs site, and MCP registry #1039

Contributors

• @zereight (3 PRs: #1038, #1039, #1048)
• @dependabot[bot] (2 PRs: #1036, #1037)

⚠️ Deprecation notice

Deprecated configuration options (e.g. GITLAB_READ_ONLY_MODE, USE_GITLAB_WIKI, and other legacy flags) still work during the grace period, but they will be removed in v3.0.0. Please migrate to the replacements described in the pinned issue #815.