@daften/fireflyiii-mcp 0.4.3-nightly.20260830T0850 → 0.4.4

package/CHANGELOG.md

@@ -7,9 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Changed
-- Releases are now cut on a short-lived `release/X.Y.Z` branch that reaches `main` as a single PR, instead of a promotion merge followed by a separate release commit on `main`. Since `backmerge.yml` runs on every push to `main`, the old shape back-merged twice per release; this shape does it once, puts the release commit through CI, and leaves `auto-release.yml` as the only thing committing directly to `main`. `backmerge.yml` itself now merges and pushes to `develop` directly, opening a PR only when the merge conflicts and needs manual resolution.
-- `CHANGELOG.md` now has a `merge=union` driver (`.gitattributes`), so `develop`'s pending `[Unreleased]` entries and `main`'s freshly-cut dated release sections no longer conflict on every back-merge — git keeps both sides automatically instead of failing.
+## [0.4.4] - 2026-09-05
+
+### Security
+
+- chore(deps): Bump qs from 6.15.2 to 6.16.0 in the security-fixes group across 1 directory (automated security release)
+
+### Fixed
+- `auto-merge.yml` still never enabled auto-merge on Dependabot security PRs. `alert-lookup` was being passed the default `GITHUB_TOKEN`, which cannot read the Dependabot alerts API; `dependabot/fetch-metadata` reports that by returning an empty `alert-state` instead of failing, so the merge step's guard stayed false while the job reported success. The metadata step now uses the `RELEASE_TOKEN` PAT (which needs `Dependabot alerts: Read only`), and a new guard step fails the job outright when a `security-fixes`-group PR produces no `alert-state`, so an expired or under-scoped token can no longer masquerade as a passing check. ([#86](https://github.com/daften/fireflyiii-mcp/pull/86))
+
+## [0.4.3] - 2026-09-03
+
+### Security
+
+- chore(deps): Bump fast-uri from 3.1.5 to 3.1.7 in the security-fixes group across 1 directory (automated security release)
 
 ## [0.4.2] - 2026-08-04
 
@@ -148,7 +159,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - npm publish provenance via GitHub OIDC.
 - GitHub Release auto-created from the tag annotation on each `v*` tag push.
 
-[Unreleased]: https://github.com/daften/fireflyiii-mcp/compare/v0.4.2...HEAD
+[Unreleased]: https://github.com/daften/fireflyiii-mcp/compare/v0.4.4...HEAD
+[0.4.4]: https://github.com/daften/fireflyiii-mcp/compare/v0.4.3...v0.4.4
+[0.4.3]: https://github.com/daften/fireflyiii-mcp/compare/v0.4.2...v0.4.3
 [0.4.2]: https://github.com/daften/fireflyiii-mcp/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/daften/fireflyiii-mcp/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/daften/fireflyiii-mcp/compare/v0.3.4...v0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daften/fireflyiii-mcp",
-  "version": "0.4.3-nightly.20260830T0850",
+  "version": "0.4.4",
   "description": "MCP server for Firefly III personal finance manager",
   "type": "module",
   "bin": {
@@ -61,14 +61,14 @@
     "hono": "^4.13.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.6",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.8",
     "dotenv-cli": "^11.0.0",
     "simple-git-hooks": "^2.13.1",
     "tsx": "^4.22.3",
     "typescript": "^7.0.2",
-    "vitepress": "2.0.0-alpha.19",
+    "vitepress": "2.0.0-alpha.18",
     "vitest": "^4.1.7"
   },
   "engines": {