@coffeerunhobby/mcp-ha-connect 1.7.3 → 1.7.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/version.d.ts +1 -1
- package/dist/version.js +1 -1
- package/docs/CHANGELOG.md +7 -0
- package/openapi.json +1 -1
- package/package.json +3 -3
- package/src/version.ts +1 -1
package/dist/version.d.ts
CHANGED
package/dist/version.js
CHANGED
package/docs/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
|
+
### 1.7.4
|
|
2
|
+
- **Security — cleared every advisory in the dependency tree** (`npm audit` and `npm audit --omit=dev` both report 0). Runtime range declarations are unchanged; all fixes are in-range lockfile bumps:
|
|
3
|
+
- Production: `undici` 6.28.0→6.29.0 (WebSocket DoS ×2, retry-interceptor response splitting), `fast-uri` 3.1.6→3.1.8 (authority injection / host confusion; via ajv), `hono` 4.13.3→4.13.11, `ip-address` 10.5.0→10.7.2, `qs` 6.15.3→6.16.0 (all three transitive under the SDK's express stack).
|
|
4
|
+
- Dev-only: `vitest` + `@vitest/coverage-v8` 4.1.10→4.1.11 (devDependency floor raised to `^4.1.11`), `brace-expansion`, `js-yaml`, `nanoid`, `postcss`; `esbuild` pinned back to 0.27.2 (the advisory covers 0.27.3–0.28.0).
|
|
5
|
+
- None of the production advisories were reachable here — the vulnerable surfaces (undici's WebSocket/retry interceptor, hono/express/qs request parsing, ip-address) are never imported by this server — but they failed the `npm audit` CI gate.
|
|
6
|
+
- **Image rebuilt on the current base**: Node 24.19.0→24.21.0 (bundled OpenSSL 3.5.7→3.5.8, bundled undici 7.29.0→7.29.1), Alpine 3.24.1→3.24.2, `curl` 8.21.0→8.22.0, `libssl3`/`libcrypto3` 3.5.8. No source changes.
|
|
7
|
+
|
|
1
8
|
### 1.7.3
|
|
2
9
|
- **Fix — stateless `GET /mcp` now returns `405 Method Not Allowed` instead of hanging forever.** In stateless mode every request gets a fresh transport, so the SDK's standalone SSE GET opened a stream that never emitted a byte and never ended. That eternal zero-byte response pinned the Cloudflare→origin keep-alive socket, and HTTP/1.1 serial semantics stalled every request queued behind it — mcp-remote's own `WWW-Authenticate` probe GET poisoned the socket its `initialize` POST was then queued on, surfacing as intermittent "Request timed out" (and occasional CF 502) for Claude Desktop / Cowork sessions. Also fixes the resource leak (each hung GET pinned a socket + a full McpServer instance). Stateful mode is unchanged. +4 regression tests (`isStatelessMcpGet`).
|
|
3
10
|
- Removed `src/wrapper.ts` — a dead legacy HTTP wrapper (unauthenticated, spawn-per-request) that nothing referenced but still compiled into the shipped image. Verified unused: n8n calls the native `/mcp` endpoint; the live server already 404'd the wrapper's `POST /` route.
|
package/openapi.json
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@coffeerunhobby/mcp-ha-connect",
|
|
3
|
-
"version": "1.7.
|
|
3
|
+
"version": "1.7.4",
|
|
4
4
|
"description": "Smart home MCP server for Home Assistant plus Local AI integration",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -50,13 +50,13 @@
|
|
|
50
50
|
"@types/ws": "^8.18.1",
|
|
51
51
|
"@typescript-eslint/eslint-plugin": "^8.19.1",
|
|
52
52
|
"@typescript-eslint/parser": "^8.19.1",
|
|
53
|
-
"@vitest/coverage-v8": "^4.
|
|
53
|
+
"@vitest/coverage-v8": "^4.1.11",
|
|
54
54
|
"esbuild": "^0.27.2",
|
|
55
55
|
"eslint": "^9.18.0",
|
|
56
56
|
"tsx": "^4.19.2",
|
|
57
57
|
"typescript": "^5.9.3",
|
|
58
58
|
"typescript-eslint": "^8.52.0",
|
|
59
|
-
"vitest": "^4.
|
|
59
|
+
"vitest": "^4.1.11"
|
|
60
60
|
},
|
|
61
61
|
"engines": {
|
|
62
62
|
"node": ">=20.0.0"
|
package/src/version.ts
CHANGED