@aborruso/ckan-mcp-server 0.4.129 → 0.4.130

package/LOG.md

@@ -1,5 +1,15 @@
 # LOG
 
+## 2026-10-19
+
+### v0.4.130
+
+Ships #561: linear shrink in `truncateJson` (GHSA-w3gp-3hrh-v465). Tests 589 passed, smoke 17/17.
+
+### Security: linear shrink in `truncateJson` (GHSA-w3gp-3hrh-v465)
+
+Reported by @olevasseur. `truncateJson()` popped one array element at a time and re-serialized the whole object after each pop: O(n²). A portal answering `status_show` (or any tool in `response_format: json`) with a ~3 MB, 32,000-item array blocked the event loop for ~59 s. Replaced with a binary search on the largest fitting prefix: same output (543 rows kept), 17 `JSON.stringify` calls instead of 31,459, 55 ms instead of 59 s. Regression test counts serializations. Tests 589 passed; e2e on dati.gov.it `status_show` and messina DataStore JSON (1000 records → 254 kept, valid JSON).
+
 ## 2026-10-06
 
 ### v0.4.129

package/dist/index.js

@@ -1137,14 +1137,26 @@ function truncateJson(obj, limit = CHARACTER_LIMIT) {
   const data = structuredClone(obj);
   for (const key of SHRINKABLE_KEYS) {
     if (Array.isArray(data[key]) && data[key].length > 0) {
-      const originalCount = data[key].length;
+      const original = data[key];
+      const originalCount = original.length;
       data["_truncated"] = true;
       data["_original_count"] = originalCount;
-      while (data[key].length > 0) {
-        data[key].pop();
-        json = JSON.stringify(data);
-        if (json.length <= limit) return json;
+      let low = 0;
+      let high = originalCount - 1;
+      let best = null;
+      while (low <= high) {
+        const mid = Math.floor((low + high) / 2);
+        data[key] = original.slice(0, mid);
+        const candidate = JSON.stringify(data);
+        if (candidate.length <= limit) {
+          best = candidate;
+          low = mid + 1;
+        } else {
+          high = mid - 1;
+        }
       }
+      if (best !== null) return best;
+      data[key] = [];
     }
   }
   const explained = JSON.stringify({
@@ -6089,7 +6101,7 @@ var registerAllPrompts = (server) => {
 function createServer() {
   return new McpServer({
     name: "ckan-mcp-server",
-    version: "0.4.129"
+    version: "0.4.130"
   });
 }
 function registerAll(server) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aborruso/ckan-mcp-server",
-  "version": "0.4.129",
+  "version": "0.4.130",
   "mcpName": "io.github.aborruso/ckan-mcp-server",
   "description": "MCP server for interacting with CKAN open data portals",
   "repository": {