@coffeerunhobby/mcp-ha-connect 1.5.4 → 1.5.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/Dockerfile +9 -5
  2. package/dist/version.d.ts +1 -1
  3. package/dist/version.js +1 -1
  4. package/openapi.json +1 -1
  5. package/package.json +1 -1
  6. package/src/version.ts +1 -1
package/Dockerfile CHANGED
@@ -1,6 +1,6 @@
1
1
  # syntax=docker/dockerfile:1.7
2
2
 
3
- FROM node:25-alpine AS deps
3
+ FROM node:26-alpine AS deps
4
4
  WORKDIR /app
5
5
  COPY package*.json ./
6
6
  # npm ci installs exactly from the committed package-lock.json (reproducible) and
@@ -8,13 +8,13 @@ COPY package*.json ./
8
8
  # above pulls in package-lock.json, so the lockfile is present in this stage.
9
9
  RUN npm ci
10
10
 
11
- FROM node:25-alpine AS build
11
+ FROM node:26-alpine AS build
12
12
  WORKDIR /app
13
13
  COPY --from=deps /app/node_modules ./node_modules
14
14
  COPY . .
15
15
  RUN npm run build
16
16
 
17
- FROM node:25-alpine AS runtime
17
+ FROM node:26-alpine AS runtime
18
18
 
19
19
  # OCI metadata labels
20
20
  LABEL org.opencontainers.image.title="MCP-HA-Connect"
@@ -27,7 +27,9 @@ LABEL org.opencontainers.image.licenses="MIT"
27
27
 
28
28
  WORKDIR /app
29
29
  ENV NODE_ENV=production
30
- RUN apk add --no-cache curl
30
+ # apk upgrade: pick up Alpine security patches even when the node base tag lags
31
+ # (the 2026-07 Trivy scan's 24 libssl/libcrypto CVEs were exactly this rot).
32
+ RUN apk upgrade --no-cache && apk add --no-cache curl
31
33
  COPY package*.json ./
32
34
  # Reproducible prod-only install from the lockfile (drops devDependencies).
33
35
  RUN npm ci --omit=dev
@@ -37,4 +39,6 @@ COPY --from=build /app/dist ./dist
37
39
  # Built artifacts under /app are world-readable, so no chown is required; the
38
40
  # server listens on 3000 (>1024) which needs no privileged capability.
39
41
  USER node
40
- CMD ["node", "--experimental-quic", "dist/index.js"]
42
+ # --experimental-quic was dropped 2026-07-10: nothing in src/ uses QUIC, and the
43
+ # flag tied the image to a specific Node major (25, now EOL) for no benefit.
44
+ CMD ["node", "dist/index.js"]
package/dist/version.d.ts CHANGED
@@ -2,4 +2,4 @@
2
2
  * Package version - hardcoded at build time for reliability
3
3
  * Keep in sync with package.json version
4
4
  */
5
- export declare const VERSION = "1.5.3";
5
+ export declare const VERSION = "1.5.5";
package/dist/version.js CHANGED
@@ -2,5 +2,5 @@
2
2
  * Package version - hardcoded at build time for reliability
3
3
  * Keep in sync with package.json version
4
4
  */
5
- export const VERSION = '1.5.3';
5
+ export const VERSION = '1.5.5';
6
6
  //# sourceMappingURL=version.js.map
package/openapi.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "openapi": "3.1.0",
3
3
  "info": {
4
4
  "title": "Home Assistant MCP Wrapper",
5
- "version": "1.5.4",
5
+ "version": "1.5.5",
6
6
  "description": "REST endpoints that wrap MCP tools for Home Assistant integration. Raw JSON-RPC passthrough available at POST / for n8n compatibility."
7
7
  },
8
8
  "servers": [
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@coffeerunhobby/mcp-ha-connect",
3
- "version": "1.5.4",
3
+ "version": "1.5.5",
4
4
  "description": "Smart home MCP server for Home Assistant plus Local AI integration",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
package/src/version.ts CHANGED
@@ -2,4 +2,4 @@
2
2
  * Package version - hardcoded at build time for reliability
3
3
  * Keep in sync with package.json version
4
4
  */
5
- export const VERSION = '1.5.4';
5
+ export const VERSION = '1.5.5';