otto 2.9.0 → 2.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0bbfc031ec4ff48d3d0ce373a4a8cbbfac62571f80a07ef54427e71a3fc34444
-  data.tar.gz: 4cf1c8c6171a8af0f18dcc61c8c00b86c9bc829b573e8e3b727b1047ad2ce230
+  metadata.gz: ebb9d40d464e54cb0a25d0014dfa6868905e833c400701739d61463ae56b7265
+  data.tar.gz: f111ef655d58256cece33215fe05a7711c5f1bd0e06925c41e58b0e492f6dfb5
 SHA512:
-  metadata.gz: c4405b81202ecf23a1f09629ccc8392a70a1fa6d0287c46ba4590517f884e527ecca5d909475b6ff772ad857def5686991c99b9b93dde9489c040d3502662f73
-  data.tar.gz: 155b0b637c48466d3ad68f91f28647c6f7a7a6cf4c60aac343af270c09a0be98f6fa5c1764d94e4886a148ee8d9f226c1567118e865404b3add638dbe50ee2a5
+  metadata.gz: c1381ef06000d127d7411f50e797dbf14720821873bc8f9b70e1e01a3a232fb7a8f2ebaee7e0ec4ed8a9d61dfc8cf8d67753de21702ef253dd42b4e1736949ea
+  data.tar.gz: 7105c5561be5e5f3cfe771b41cc1d576c0ede262cecc92347cc518cbdd0c57deaefca50a923a535661a47ac6a977a1171a6dab9cb3f9ff59ca993c5a1a2d326a

data/.github/dependabot.yml

@@ -9,6 +9,11 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    # All action bumps arrive as one PR instead of one per action.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
   - package-ecosystem: "bundler"
     directory: "/" # Location of package manifests
     schedule:

data/.github/workflows/ci.yml

@@ -28,15 +28,18 @@ jobs:
       fail-fast: false
       matrix:
         # Each Ruby runs twice: once against the committed Gemfile.lock
-        # (floor of the declared version range, reproducible) and once
-        # with the lockfile removed so Bundler resolves fresh inside the
-        # gemspec's pessimistic constraints (ceiling, what a downstream
-        # user will actually hit). The unlocked cells catch upstream
-        # releases that satisfy `~> X.Y` but break Otto at load time -
+        # (the reproducible maintainer snapshot) and once with the lockfile
+        # removed so Bundler resolves currently available versions inside the
+        # gemspec constraints. Neither resolution is a patched security floor;
+        # consumers must audit their own lockfiles. The unlocked cells catch
+        # upstream releases that satisfy `~> X.Y` but break Otto at load time -
         # e.g. facets 3.2.0 shipping a self-referential
         # `require_relative 'file/write.rb'` against a file deleted in
         # the same release, the reason 2.0.2 exists.
         include:
+          # Ruby 3.2 is EOL upstream but remains a blocking compatibility
+          # target. Ruby 3.5 and 4.0 remain provisional, non-blocking targets.
+          # See docs/reference/runtime-and-dependency-security.md.
           - ruby: "3.2"
             experimental: false
             lockfile: "locked"
@@ -69,9 +72,9 @@ jobs:
             lockfile: "unlocked"
 
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         continue-on-error: ${{ matrix.experimental }}
         with:
           ruby-version: ${{ matrix.ruby }}
@@ -80,7 +83,7 @@ jobs:
           bundler-cache: ${{ !matrix.experimental && matrix.lockfile == 'locked' }}
 
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3
+        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
         with:
           detached: true

data/.github/workflows/claude-code-review.yml

@@ -30,13 +30,20 @@ jobs:
     #      CLAUDE_CODE_OAUTH_TOKEN is empty and the action would fail.
     #   3. The event is a freshly opened PR, a 'claude-review' label add, or a push
     #      to a PR that already carries the 'claude-review' label.
+    # A manual workflow_dispatch run bypasses 2 and 3 (it can only be started by a
+    # user with write access, on a branch in this repo) but still skips bots.
     if: ${{
       !endsWith(github.actor, '[bot]') &&
-      !github.event.pull_request.head.repo.fork &&
       (
-        (github.event.action == 'opened') ||
-        (github.event.action == 'labeled' && github.event.label.name == 'claude-review') ||
-        (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'claude-review'))
+        github.event_name == 'workflow_dispatch' ||
+        (
+          !github.event.pull_request.head.repo.fork &&
+          (
+            (github.event.action == 'opened') ||
+            (github.event.action == 'labeled' && github.event.label.name == 'claude-review') ||
+            (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'claude-review'))
+          )
+        )
       )
       }}
 
@@ -48,13 +55,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@d75b94d5ad426cb8546e6628b6f5f19b84e5cce1 # v1.0.216
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -62,11 +69,26 @@ jobs:
           # runs) -> the CLAUDE_MODEL repo variable -> this built-in default.
           # Pinning a current id avoids the action's frozen default, which 404s
           # ("model: claude-sonnet-4-20250514"). Fall back to Sonnet on overload.
-          model: "${{ inputs.model || vars.CLAUDE_MODEL || 'claude-opus-4-6' }}"
-          fallback_model: "${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}"
+          # v1 removed the model/fallback_model inputs; both are now CLI flags
+          # passed through claude_args.
+          claude_args: |
+            --model ${{ inputs.model || vars.CLAUDE_MODEL || 'claude-opus-4-6' }}
+            --fallback-model ${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}
+
+          # Prompt for automated review (no @claude mention needed).
+          # v1 renamed direct_prompt -> prompt. track_progress restores the
+          # tracking/sticky comment that v0 automation mode posted by default; it
+          # only applies to pull_request/issue events, so a workflow_dispatch run
+          # has no PR to comment on and reports to the job log instead.
+          track_progress: true
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number || 'none (manual run)' }}
+
+            If no PR number is given, use `gh` to find an open pull request whose
+            head is ${{ github.ref_name }}; if there is none, say so and stop.
+            (The checkout is shallow, so compare via the API, not local git.)
 
-          # Direct prompt for automated review (no @claude mention needed)
-          direct_prompt: |
             Please review this pull request and provide feedback on:
             - Code quality and best practices
             - Potential bugs or issues
@@ -80,9 +102,12 @@ jobs:
           use_sticky_comment: true
 
       - name: Remove claude-review label
-        # Remove label whether success or failure - prevents getting stuck
-        if: always() && github.event.action != 'opened'
-        uses: actions/github-script@v9
+        # Remove label whether success or failure - prevents getting stuck.
+        # Only for pull_request events: a workflow_dispatch payload has no
+        # issue number, so context.issue.number would be undefined and the
+        # removeLabel call would fail (silently, below) with the label intact.
+        if: always() && github.event_name == 'pull_request' && github.event.action != 'opened'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {

data/.github/workflows/claude.yml

@@ -26,13 +26,13 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@d75b94d5ad426cb8546e6628b6f5f19b84e5cce1 # v1.0.216
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -40,8 +40,11 @@ jobs:
           # editing this file. Pinning a current id avoids the action's frozen
           # default, which 404s ("model: claude-sonnet-4-20250514"). Fall back to
           # Sonnet if the primary is unavailable or overloaded.
-          model: "${{ vars.CLAUDE_MODEL || 'claude-opus-4-6' }}"
-          fallback_model: "${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}"
+          # v1 removed the model/fallback_model inputs; both are now CLI flags
+          # passed through claude_args.
+          claude_args: |
+            --model ${{ vars.CLAUDE_MODEL || 'claude-opus-4-6' }}
+            --fallback-model ${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}
 
           # This is an optional setting that allows Claude to read CI results on PRs
           additional_permissions: |
@@ -50,7 +53,6 @@ jobs:
           # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
           # prompt: 'Update the pull request description to include a summary of changes.'
 
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options
-          # claude_args: '--model claude-opus-4-1-20250805 --allowed-tools Bash(gh pr:*)'
+          # More claude_args options (tool allowlists, --max-turns, --mcp-config):
+          # https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line

data/.github/workflows/code-smells.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 3.4
 
@@ -71,7 +71,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload Reek report as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: reek-report
@@ -88,10 +88,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 3.4
           bundler-cache: true

data/.github/workflows/release-gem.yml

@@ -139,7 +139,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           # Pinned to 3.3 (oldest non-experimental Ruby in the CI matrix).
@@ -169,4 +169,4 @@ jobs:
           echo "Releasing otto ${gem_version} from tag ${RELEASE_TAG}"
 
       - name: Build and push gem to RubyGems
-        uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092 # v1.4.0
+        uses: rubygems/release-gem@7f9650160c1a4e7989fdc9855807bdbd421d8b6b # v1.4.1

data/.github/workflows/ruby-lint.yml

@@ -44,15 +44,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3
+        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
         with:
           detached: true

data/.github/workflows/yardoc.yml

@@ -42,12 +42,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Ruby environment
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.4'
           bundler-cache: true
@@ -82,10 +82,10 @@ jobs:
           echo "::endgroup::"
 
       - name: Setup GitHub Pages configuration
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload documentation artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: './doc'
 
@@ -102,7 +102,7 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
 
   notify-completion:
     timeout-minutes: 5

data/.gitignore

@@ -1,19 +1,14 @@
 .DS_Store
 .bundle
-.byebug*
 .history
 .devcontainer
 .vscode
 *.env
 *.log
-*.md
 *.txt
 .*.json
 !LICENSE.txt
 !spec/fixtures/*.txt
-!examples/**/*.md
-!README.md
-!CLAUDE.md
 .ruby-version
 appendonlydir
 data/
@@ -27,3 +22,4 @@ vendor
 .mcp.json
 .claude
 .serena
+.yardoc

data/.rubocop_todo.yml

@@ -296,15 +296,11 @@ Lint/DuplicateMethods:
   Exclude:
     - 'lib/otto/privacy/geo_resolver.rb'
 
-# Offense count: 5
+# Offense count: 1
 # Configuration parameters: AllowedParentClasses.
 Lint/MissingSuper:
   Exclude:
     - 'lib/otto/mcp/rate_limiting.rb'
-    - 'lib/otto/security/authentication/strategies/api_key_strategy.rb'
-    - 'lib/otto/security/authentication/strategies/permission_strategy.rb'
-    - 'lib/otto/security/authentication/strategies/role_strategy.rb'
-    - 'lib/otto/security/authentication/strategies/session_strategy.rb'
 
 # Offense count: 12
 # This cop supports unsafe autocorrection (--autocorrect-all).
@@ -601,6 +597,9 @@ RSpec/DescribeMethod:
     - 'spec/otto/initialization_spec.rb'
     - 'spec/otto/locale_config_spec.rb'
     - 'spec/otto/mcp/rate_limiting_spec.rb'
+    - 'spec/otto/mcp/protocol_spec.rb'
+    - 'spec/otto/mcp/registry_spec.rb'
+    - 'spec/otto/mcp/route_parser_spec.rb'
     - 'spec/otto/mcp_route_parsing_spec.rb'
     - 'spec/otto/rate_limiting_spec.rb'
     - 'spec/otto/response_integration_spec.rb'
@@ -863,6 +862,9 @@ RSpec/SpecFilePathFormat:
     - 'spec/otto/file_safety_spec.rb'
     - 'spec/otto/locale_config_spec.rb'
     - 'spec/otto/mcp/rate_limiting_spec.rb'
+    - 'spec/otto/mcp/protocol_spec.rb'
+    - 'spec/otto/mcp/registry_spec.rb'
+    - 'spec/otto/mcp/route_parser_spec.rb'
     - 'spec/otto/mcp/token_auth_spec.rb'
     - 'spec/otto/mcp_route_parsing_spec.rb'
     - 'spec/otto/rate_limiting_spec.rb'

data/AGENTS.md

@@ -2,6 +2,27 @@
 
 This file provides essential guidance to AI agents when working with Otto.
 
+## Project claims and source authority
+
+### Attribution
+
+Do not infer project terminology or guarantees from repetition. Before attributing a claim to the project, locate an authoritative primary source and provide its exact wording. Treat delivery notes, commit messages, agent output, and documents created or modified during the current task as leads, not evidence. If the wording is absent, call it an interpretation or proposal. Never place paraphrases in quotation marks.
+
+### Authoritative sources
+
+Authoritative sources must be identified explicitly; repository presence alone does not confer authority. Accepted specifications and ADRs may establish project claims only within their stated scope. Delivery notes, commit messages, issue discussions, summaries, and agent-authored text are non-authoritative unless an authoritative source incorporates them explicitly.
+
+### Normative claims
+
+For normative claims concerning security, privacy, compatibility, persistence, or data loss:
+
+1. Cite the authoritative source and its exact wording.
+2. Distinguish quotations, paraphrases, interpretations, and proposals.
+3. Do not use material created or modified during the current task to validate that task’s claims.
+4. If no authoritative wording exists, report the claim as unsupported.
+
+
+
 ## Error Handler Registration
 
 Register handlers for expected business logic errors to avoid logging them as 500 errors:
@@ -56,7 +77,7 @@ Authentication is handled by `RouteAuthWrapper` at the handler level, NOT by mid
 
 ```ruby
 otto.add_auth_strategy('session', SessionStrategy.new)
-otto.add_auth_strategy('apikey', APIKeyStrategy.new)
+otto.add_auth_strategy('apikey', APIKeyStrategy.new(api_keys: ENV.fetch('API_KEYS').split(',')))
 ```
 
 - Strategy names must be unique

data/CHANGELOG.rst

@@ -7,6 +7,171 @@ The format is based on `Keep a Changelog <https://keepachangelog.com/en/1.1.0/>`
 
    <!--scriv-insert-here-->
 
+.. _changelog-2.10.0:
+
+2.10.0 — 2026-09-04
+===================
+
+Added
+-----
+
+- ``APIKeyStrategy`` now accepts a block or ``resolver:`` callable instead of a
+  static ``api_keys:`` list, enabling database-, repository-, or cache-backed
+  key lookup. The resolved account becomes the authenticated user.
+
+- ``APIKeyStrategy.digest(key)`` returns a full SHA-256 hex digest for stores
+  that look up generated API keys by digest. See
+  ``docs/guides/authentication.md`` for the resolver contract and credential
+  storage guidance.
+
+- Directly exposed applications can now set ``trusted_proxies: :none`` or call
+  ``trust_no_proxies!`` to distrust every peer. Otto then ignores forwarded
+  client IPs and strips forwarded host, scheme, and port metadata. Leaving proxy
+  trust unconfigured continues to preserve forwarded metadata. Applications
+  behind a reverse proxy, including one on loopback, must explicitly trust it.
+  The sentinel is only valid as the whole option; a list containing it, such
+  as ``['none']``, is rejected at configuration time. See
+  ``docs/guides/forwarded-authority.md`` for configuration guidance. (#259)
+
+Changed
+-------
+
+- MCP options now accept String or Symbol keys consistently and fail at boot
+  for unknown, conflicting, or invalid values. Constructor gating options must
+  be exactly ``true`` or ``false``; nil or blank token values are rejected.
+  Before upgrading, check option names against the `MCP guide
+  <docs/guides/mcp.md>`__. (#258)
+
+- ``enable_mcp!`` now rejects constructor-only gating options and repeated
+  enablement. Pass all MCP settings in one ``Otto.new`` or ``enable_mcp!`` call.
+  (#258)
+
+- MCP ``Rack::Attack`` throttle names are now endpoint-qualified, such as
+  ``mcp_requests:/_mcp`` and ``mcp_tool_calls:/_mcp``. Update integrations that
+  inspect throttle names directly. (#258)
+
+- Otto applications in one process that resolve proxied requests must now use
+  the same forwarded-header family; incompatible configurations fail during
+  configuration. CIDR-based proxy trust supports only ``X-Forwarded-*`` headers; use
+  depth-based trust for ``Forwarded`` or both families. See
+  ``docs/guides/forwarded-authority.md`` for configuration guidance. (#252)
+
+- Literal routes now consistently take precedence over static files at the same
+  path, regardless of which static files were requested earlier. Static files
+  continue to take precedence over dynamic routes. (#260)
+
+- MaxMind-backed database paths now require ``maxmind-db ~> 1.2``. Before
+  upgrading, declare that range or provide a compatible reader object. See the
+  `geo-country <docs/guides/geo-country.md>`__ and
+  `enrichment <docs/guides/enrichment.md>`__ guides. (#255)
+
+Removed
+-------
+
+- Removed ``add_static_path`` and the ``routes_static`` cache interface. Static
+  files are discovered directly from the configured ``public`` directory and
+  no longer need registration. (#260)
+
+- Removed the unused ``rack-parser`` and ``rexml`` runtime dependencies.
+  Applications using either gem directly must now declare it themselves.
+  (#255)
+
+Fixed
+-----
+
+- MCP middleware now executes rate limiting, authentication, and schema
+  validation in that order. Configured endpoints with a trailing slash are also
+  routable. (#258)
+
+- Repeated MCP rate-limit configuration no longer produces duplicate throttle
+  log entries. (#258)
+
+- MCP JSON-RPC errors now consistently use HTTP 400 for protocol errors, 404
+  for unknown resources or tools, and 500 for handler or server failures.
+  Unknown tools no longer return 500, failing resource handlers no longer
+  appear missing, and handler exception details are logged instead of returned
+  to clients. (#257)
+
+- ``StrategyResult#has_role?`` and ``#has_permission?`` now derive their answer
+  from ``#roles`` and ``#permissions``, so the predicates agree with the
+  accessors for object-backed users exposing ``#roles`` and for ``Set`` or
+  other non-Array collections. A user model defining its own ``#has_role?`` or
+  ``#has_permission?`` is still consulted first.
+
+- MCP rate-limited requests now emit one ``rack.attack`` log entry instead of
+  two. (#255)
+
+Security
+--------
+
+- ``APIKeyStrategy`` now requires exactly one key source and rejects empty
+  static key lists at construction. Invalid presented credentials terminate a
+  multi-strategy authentication chain. Static keys are compared in constant
+  time as fixed-width SHA-256 digests, so configured key lengths are not
+  observable through timing. Blank credentials, empty or whitespace-only, are
+  rejected before any key source is consulted. (#256)
+
+- Successful authentication results no longer expose the raw API key in
+  strategy-generated fields. Static-list callers should replace
+  ``user[:api_key]`` with ``user[:api_key_fingerprint]``. (#256)
+
+- ``APIKeyStrategy`` now reads only the configured header by default. Applications
+  that still accept query or form parameters must opt in with ``param_name:``;
+  see ``docs/guides/authentication.md`` for configuration guidance. (#256)
+
+- Fixed MCP bearer-token authentication being silently omitted when configured
+  through ``Otto.new`` or with String-keyed options. Deployments exposing MCP
+  beyond a trusted local environment should upgrade and verify their
+  ``auth_tokens`` configuration. Intentionally open endpoints now warn unless
+  acknowledged with ``allow_unauthenticated: true``. See the `MCP guide
+  <docs/guides/mcp.md>`__. (#258)
+
+- MCP authentication now fails closed when its authenticator is unavailable.
+  Authentication, validation, and rate limiting also apply only to the exact
+  routed MCP endpoint. (#258)
+
+- MCP rate limiting now honors configured limits and protects custom endpoints,
+  Rack-mounted applications, and distinct MCP endpoints in the same process.
+  Mount ``Rack::Attack`` inside the same ``map`` block as Otto, and use distinct
+  endpoint paths when applications require isolated counters. (#258)
+
+- Static-file serving now rejects symlinks that resolve outside the configured
+  public directory, preventing files outside that root from being served on
+  first access or after another file has populated the directory cache.
+  Symlinks that resolve within the public directory, including a symlinked
+  public root, remain supported. (#257)
+
+- When proxy trust is configured, forwarded host, scheme, and port metadata
+  from untrusted peers is now stripped before it can affect Rack's request
+  authority. Requests from trusted peers retain this metadata; see
+  ``docs/guides/forwarded-authority.md`` for deployment guidance. (#252)
+
+- ``IPPrivacyMiddleware`` enforces its own proxy trust posture even when an
+  outer instance already resolved ``otto.client_ip``. ``trusted_proxies: :none``
+  always strips forwarded authority; a CIDR configuration that can no longer
+  match the connecting peer treats it as untrusted and logs a warning. (#259)
+
+- ``env['otto.peer_relayed']`` records whether a request carried any relay
+  marker header, evaluated before forwarded carriers may be deleted, so
+  ``Otto::CaddyTLS::LocalhostGuard`` still refuses a relayed loopback call once
+  the carriers are stripped. The relay markers cover every carrier the scrub
+  deletes, including ``X-Forwarded-Host`` and the other authority headers, not
+  only the client-IP carriers. (#259)
+
+- MCP now stops configuration with ``Otto::OptionalDependencyError`` rather
+  than starting without enabled schema validation or rate limiting. Before
+  upgrading, add ``json_schemer ~> 2.0`` and ``rack-attack ~> 6.7`` for the
+  default protections, or explicitly set ``enable_validation: false`` or
+  ``enable_rate_limiting: false`` only when that protection is not required.
+  See the `MCP guide <docs/guides/mcp.md>`__. (#255)
+
+Documentation
+-------------
+
+- Added the `MCP guide <docs/guides/mcp.md>`__ covering secure enablement,
+  supported options, authentication, validation, rate limiting, mounted
+  applications, and error behavior. (#258)
+
 .. _changelog-2.9.0:
 
 2.9.0 — 2026-08-18
@@ -790,6 +955,44 @@ Added
 2.0.0 — 2026-03-14
 ==================
 
+This is the stable release of Otto v2, the culmination of 10 pre-releases
+since September 2025.
+
+Highlights
+----------
+
+- **Modular architecture**: the core ``Otto`` class is now a thin composition
+  of focused modules (Router, FileSafety, Configuration, ErrorHandler,
+  UriGenerator).
+- **Security by default**: IP masking, user agent anonymization, CSRF
+  protection, input validation, and backtrace sanitization.
+- **Privacy by default**: public IP masking, country-level geo-location only
+  (no external APIs), daily-rotating IP hashes for analytics.
+- **Handler-level authentication**: authentication moved from middleware to
+  ``RouteAuthWrapper``, so it runs after routing.
+- **Configuration freezing**: configuration is frozen after the first request
+  to prevent runtime security bypasses.
+- **MCP support**: JSON-RPC 2.0 endpoints for CLI automation and integrations.
+- **Base error classes**: ``NotFoundError``, ``BadRequestError``,
+  ``ForbiddenError`` and friends, with automatic HTTP status codes.
+- **Request/response helpers**: extensible ``Otto::Request`` and
+  ``Otto::Response`` with application-specific helper registration.
+
+Breaking changes
+----------------
+
+Individual breaking changes are documented in the pre-release entries below.
+The migrations most applications need:
+
+- Logic class constructor: ``initialize(session, user, params, locale)`` →
+  ``initialize(context, params, locale)``
+- Middleware stack: ``otto.middleware_stack <<`` → ``otto.use()``
+- Request callbacks: ``Otto.on_request_complete`` → ``otto.on_request_complete``
+  (instance method)
+
+See `docs/migrating/v2.0.0.md <docs/migrating/v2.0.0.md>`__ for the full
+upgrade guide.
+
 Added
 -----
 

data/Gemfile

@@ -18,9 +18,9 @@ end
 # bundle config set with 'optional'
 group :development, :test, optional: true do
   # Keep gems that need to be in both environments
-  gem 'json_schemer'
+  gem 'json_schemer', '~> 2.0'
   gem 'maxmind-db', '~> 1.2' # Optional geo DB reader; exercised by geo specs
-  gem 'rack-attack'
+  gem 'rack-attack', '~> 6.7'
   gem 'reek', '~> 6.5'
 end
 
@@ -29,7 +29,7 @@ group :development do
   gem 'debug'
   gem 'rackup' # Used to boot examples/ apps; not needed by specs
   gem 'rake', '~> 13.4', require: false # Provides `rake release` for release-gem.yml
-  gem 'rubocop', '~> 1.89.0', require: false
+  gem 'rubocop', '~> 1.90.0', require: false
   gem 'rubocop-performance', require: false
   gem 'rubocop-rspec', require: false
   gem 'rubocop-thread_safety', require: false