@cairnkeep/cli 2.19.0 → 2.19.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +13 -1
- package/docs/learning/CURRICULUM-MAP.md +1 -1
- package/docs/learning/FEATURE-GUIDE.md +1 -1
- package/docs/learning/lessons/L00-why-cairnkeep.md +1 -1
- package/docs/learning/lessons/L01-safe-trial.md +1 -1
- package/docs/learning/lessons/L02-installation.md +1 -1
- package/docs/learning/lessons/L03-first-project.md +1 -1
- package/docs/learning/lessons/L19-validated-skill-improvement.md +1 -1
- package/docs/learning/lessons/L20-mcp-tool-profiles.md +1 -1
- package/docs/learning/lessons/L21-context-packs.md +1 -1
- package/docs/learning/lessons/L22-native-windows.md +1 -1
- package/docs/learning/lessons/L23-guided-setup.md +1 -1
- package/docs/learning/lessons/L24-okf-exchange.md +1 -1
- package/docs/learning/lessons/L25-playbooks.md +1 -1
- package/examples/eval/bundled-fake.json +1 -1
- package/mcp-memory-server/package.json +1 -1
- package/package.json +2 -2
- package/scripts/verify-dependency-security.mjs +20 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,17 @@ All notable user-facing changes are documented here. This project follows
|
|
|
5
5
|
|
|
6
6
|
## [Unreleased]
|
|
7
7
|
|
|
8
|
+
## [2.19.1] - 2026-10-06
|
|
9
|
+
|
|
10
|
+
### Security
|
|
11
|
+
|
|
12
|
+
- Upgrade the MCP SDK floor to 1.32.1 and refresh both production lock graphs
|
|
13
|
+
so `fast-uri` 3.1.8, `hono` 4.13.13, `ip-address` 10.7.3, and
|
|
14
|
+
`proxy-addr` 2.0.8 exclude the newly disclosed URI-normalization, request
|
|
15
|
+
parsing, SSRF, denial-of-service, XSS, and proxy-trust advisories.
|
|
16
|
+
- Extend the dependency-security gate to reject future lockfile regressions
|
|
17
|
+
below those patched transitive versions.
|
|
18
|
+
|
|
8
19
|
## [2.19.0] - 2026-09-28
|
|
9
20
|
|
|
10
21
|
### Added
|
|
@@ -572,7 +583,8 @@ stored memories.
|
|
|
572
583
|
- Preserve executable permissions and Bash 3.2 portability on macOS.
|
|
573
584
|
- Add backup-first uninstall and SQLite-safe memory export/import guidance.
|
|
574
585
|
|
|
575
|
-
[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.
|
|
586
|
+
[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.1...HEAD
|
|
587
|
+
[2.19.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.0...v2.19.1
|
|
576
588
|
[2.19.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.18.0...v2.19.0
|
|
577
589
|
[2.18.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.17.3...v2.18.0
|
|
578
590
|
[2.15.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.15.0...v2.15.1
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"identifier":"cairn-offline-fake-v1","package_version":"2.19.
|
|
1
|
+
{"identifier":"cairn-offline-fake-v1","package_version":"2.19.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cairnkeep/cli",
|
|
3
|
-
"version": "2.19.
|
|
3
|
+
"version": "2.19.1",
|
|
4
4
|
"description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"node": ">=22"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@modelcontextprotocol/sdk": "^1.
|
|
41
|
+
"@modelcontextprotocol/sdk": "^1.32.1",
|
|
42
42
|
"agentfs-sdk": "^0.6.4",
|
|
43
43
|
"yaml": "2.9.0",
|
|
44
44
|
"zod": "^4.4.3"
|
|
@@ -4,8 +4,14 @@ import { readFileSync } from "node:fs";
|
|
|
4
4
|
import { resolve } from "node:path";
|
|
5
5
|
|
|
6
6
|
const ROOT = resolve(process.cwd());
|
|
7
|
-
const MINIMUM_SDK = [1,
|
|
7
|
+
const MINIMUM_SDK = [1, 32, 1];
|
|
8
8
|
const MINIMUM_NODE_SERVER = [2, 0, 5];
|
|
9
|
+
const TRANSITIVE_MINIMUMS = new Map([
|
|
10
|
+
["fast-uri", [3, 1, 8]],
|
|
11
|
+
["hono", [4, 13, 13]],
|
|
12
|
+
["ip-address", [10, 7, 3]],
|
|
13
|
+
["proxy-addr", [2, 0, 8]],
|
|
14
|
+
]);
|
|
9
15
|
const DIRECT_HONO_PACKAGES = new Set(["hono", "@hono/node-server"]);
|
|
10
16
|
const PACKAGE_ROOTS = [
|
|
11
17
|
{ label: "root", directory: "." },
|
|
@@ -110,11 +116,23 @@ function verifyPackageRoot({ label, directory }) {
|
|
|
110
116
|
`${label} resolved @hono/node-server`,
|
|
111
117
|
);
|
|
112
118
|
}
|
|
119
|
+
|
|
120
|
+
for (const [packageName, minimum] of TRANSITIVE_MINIMUMS) {
|
|
121
|
+
const packages = resolvedPackages(lock, packageName);
|
|
122
|
+
assert.ok(packages.length > 0, `${label}: resolved ${packageName} is missing`);
|
|
123
|
+
for (const [path, packageValue] of packages) {
|
|
124
|
+
assertMinimum(
|
|
125
|
+
parseVersion(packageValue.version, `${label} ${path}`),
|
|
126
|
+
minimum,
|
|
127
|
+
`${label} resolved ${packageName}`,
|
|
128
|
+
);
|
|
129
|
+
}
|
|
130
|
+
}
|
|
113
131
|
}
|
|
114
132
|
|
|
115
133
|
try {
|
|
116
134
|
PACKAGE_ROOTS.forEach(verifyPackageRoot);
|
|
117
|
-
process.stdout.write("PASS: dependency manifests and lock graphs
|
|
135
|
+
process.stdout.write("PASS: dependency manifests and lock graphs exclude known MCP transport advisories\n");
|
|
118
136
|
} catch (error) {
|
|
119
137
|
process.stderr.write(`FAIL: dependency security policy: ${error instanceof Error ? error.message : String(error)}\n`);
|
|
120
138
|
process.exitCode = 1;
|