@daften/fireflyiii-mcp 0.3.3 → 0.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +10 -1
  2. package/package.json +3 -2
package/CHANGELOG.md CHANGED
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [0.3.4] - 2026-07-22
9
+
10
+ ### Security
11
+ - **Forced the transitive `@hono/node-server` dependency to ^2.0.5 via an npm override**, resolving [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9) (medium severity), a path traversal in its `serve-static` module on Windows via encoded backslashes. The package comes in through `@modelcontextprotocol/sdk`, which pins `^1.19.9` — below the patched 2.0.5. This server was not exploitable: the SDK only uses `serve`/`getRequestListener`, never the vulnerable `serveStatic`, and the flaw is Windows-only. The override closes the alert until the SDK moves to 2.x upstream.
12
+ - **Bumped transitive `fast-uri` from 3.1.2 to 3.1.4**, resolving two high-severity host-confusion vulnerabilities: [GHSA-4c8g-83qw-93j6](https://github.com/advisories/GHSA-4c8g-83qw-93j6) (failed IDN canonicalization) and [GHSA-v2hh-gcrm-f6hx](https://github.com/advisories/GHSA-v2hh-gcrm-f6hx) (literal backslash accepted as authority delimiter).
13
+ - **Bumped transitive `hono` from 4.12.25 to 4.12.31**, resolving three medium-severity vulnerabilities fixed in 4.12.27: [GHSA-xgm2-5f3f-mvvc](https://github.com/advisories/GHSA-xgm2-5f3f-mvvc) (API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication), [GHSA-w62v-xxxg-mg59](https://github.com/advisories/GHSA-w62v-xxxg-mg59) (server-side XSS via JSX escaping bypass in the `cx()` utility), and [GHSA-hvrm-45r6-mjfj](https://github.com/advisories/GHSA-hvrm-45r6-mjfj) (`hono/jsx` context not isolated per request, allowing cross-request data disclosure).
14
+ - **Bumped transitive `body-parser` from 2.2.2 to 2.3.0**, resolving [GHSA-v422-hmwv-36x6](https://github.com/advisories/GHSA-v422-hmwv-36x6) (low severity), a denial of service where an invalid `limit` value silently disables request-size enforcement.
15
+
8
16
  ## [0.3.3] - 2026-07-21
9
17
 
10
18
  ### Security
@@ -102,7 +110,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
102
110
  - npm publish provenance via GitHub OIDC.
103
111
  - GitHub Release auto-created from the tag annotation on each `v*` tag push.
104
112
 
105
- [Unreleased]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.3...HEAD
113
+ [Unreleased]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.4...HEAD
114
+ [0.3.4]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.3...v0.3.4
106
115
  [0.3.3]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.2...v0.3.3
107
116
  [0.3.2]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.1...v0.3.2
108
117
  [0.3.1]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.0...v0.3.1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@daften/fireflyiii-mcp",
3
- "version": "0.3.3",
3
+ "version": "0.3.4",
4
4
  "description": "MCP server for Firefly III personal finance manager",
5
5
  "type": "module",
6
6
  "bin": {
@@ -56,8 +56,9 @@
56
56
  "zod": "^4.4.3"
57
57
  },
58
58
  "overrides": {
59
+ "@hono/node-server": "^2.0.5",
59
60
  "esbuild": "^0.28.1",
60
- "hono": "^4.12.25"
61
+ "hono": "^4.12.31"
61
62
  },
62
63
  "devDependencies": {
63
64
  "@biomejs/biome": "2.5.4",