@dpesch/mantisbt-mcp-server 1.13.0 → 1.14.0

package/CHANGELOG.md

@@ -11,6 +11,23 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.14.0] – 2026-09-27
+
+### Fixed
+
+- `create_issue` / `update_issue`: a `custom_fields` entry without `value` is now rejected with a validation error. Previously it was accepted and the literal string `"undefined"` was written to the custom field.
+
+### Changed
+
+- **Minimum Node.js version is now 22** (`engines: >=22`). Node.js 18 and 20 are end-of-life and no longer receive security updates; the test toolchain (vitest 5) no longer runs on them, so they could not be tested anymore. CI now runs on Node.js 22. Users on Node.js 20 or older should upgrade — npm only warns about the `engines` mismatch, but these versions are no longer tested.
+- Dependencies: `zod` 4 (the MCP SDK supports `^3.25 || ^4`). Tool parameters, types and defaults are unchanged. The published JSON schemas differ slightly: nested `$ref`s are inlined, integer IDs carry an explicit `maximum`, and objects no longer declare `additionalProperties: false` (unknown keys were and still are ignored).
+- Dependencies: `@huggingface/transformers` 4 for the optional semantic search. Embeddings are numerically identical to version 3 (verified with the default model), so existing search indexes stay valid — no rebuild needed. This also resolves the `sharp` security advisories reported by `npm audit`.
+- Dependencies: `@modelcontextprotocol/sdk` minimum raised to ^1.30.1; transitive dependencies updated to resolve all `npm audit` advisories (including a critical one in `tar`).
+- Dev dependencies: vitest and `@vitest/coverage-v8` 5, `@types/node` 22 (matching the minimum Node.js version).
+- CI: the publish job now checks `NPM_TOKEN` and `GH_RELEASE_TOKEN` before `npm publish`, so an empty or invalid token stops the release before anything is published. Each publish step (npm, Codeberg release, GitHub release) is skipped when its target already exists, so re-running a failed job only catches up on what is missing.
+
+---
+
 ## [1.13.0] – 2026-09-27
 
 ### Added

package/README.de.md

@@ -12,7 +12,7 @@ Ein [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) Server, der
 
 ## Voraussetzungen
 
-- Node.js ≥ 18
+- Node.js ≥ 22
 - MantisBT-Installation mit aktivierter REST-API (ab Version 2.23)
 - MantisBT API-Token (unter *Mein Konto → API-Token* erstellen)
 

package/README.md

@@ -12,7 +12,7 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that i
 
 ## Requirements
 
-- Node.js ≥ 18
+- Node.js ≥ 22
 - MantisBT installation with REST API enabled (version 2.23+)
 - MantisBT API token (create under *My Account → API Tokens*)
 

package/dist/search/tools.js

@@ -47,8 +47,7 @@ export function registerSearchTools(server, client, store, embedder) {
                 'When provided, each matching issue is fetched from MantisBT and enriched with the requested fields. ' +
                 'The relevance score is always included. Without this parameter only id and score are returned.'),
             highlight: z
-                .preprocess(coerceBool, z.boolean())
-                .default(false)
+                .preprocess(coerceBool, z.boolean().default(false))
                 .describe('If true, adds a "highlights" field per result with query terms bolded (**term**) ' +
                 'in the issue summary and a short description snippet. ' +
                 'Note: highlights are keyword-based, not semantic — some results may have no highlighted terms.'),

package/dist/tools/projects.js

@@ -85,8 +85,8 @@ By default, obsolete and inherited parent-project versions are excluded. Set obs
 Prerequisites: obtain project_id from list_projects.`,
         inputSchema: z.object({
             project_id: z.coerce.number().int().positive().describe('Numeric project ID — use list_projects to discover project IDs'),
-            obsolete: z.preprocess(coerceBool, z.boolean()).default(false).describe('Include obsolete (deprecated) versions in the response. Default: false. Set to true to see all versions including those no longer actively used.'),
-            inherit: z.preprocess(coerceBool, z.boolean()).default(false).describe('Include versions inherited from parent projects. Default: false. Set to true for sub-projects that share versions with a parent project.'),
+            obsolete: z.preprocess(coerceBool, z.boolean().default(false)).describe('Include obsolete (deprecated) versions in the response. Default: false. Set to true to see all versions including those no longer actively used.'),
+            inherit: z.preprocess(coerceBool, z.boolean().default(false)).describe('Include versions inherited from parent projects. Default: false. Set to true for sub-projects that share versions with a parent project.'),
         }),
         annotations: {
             readOnlyHint: true,

package/dist/tools/version.js

@@ -27,7 +27,7 @@ export function registerVersionTools(server, client, versionHint, mcpVersion) {
 The version is read from the X-Mantis-Version response header sent by every API call.
 The GitHub comparison requires an outbound HTTPS request to the GitHub API.`,
         inputSchema: z.object({
-            check_latest: z.preprocess(coerceBool, z.boolean()).default(true).describe('Whether to fetch the latest release from GitHub and compare (default: true)'),
+            check_latest: z.preprocess(coerceBool, z.boolean().default(true)).describe('Whether to fetch the latest release from GitHub and compare (default: true)'),
         }),
         annotations: {
             readOnlyHint: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dpesch/mantisbt-mcp-server",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "mcpName": "io.github.dpesch/mantisbt-mcp-server",
   "description": "MCP server for MantisBT REST API – read and manage bug tracker issues",
   "author": "Dominik Pesch",
@@ -44,18 +44,18 @@
     "init": "node scripts/init.mjs"
   },
   "dependencies": {
-    "@huggingface/transformers": "^3.0.0",
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^3.22.4"
+    "@huggingface/transformers": "^4.3.0",
+    "@modelcontextprotocol/sdk": "^1.30.1",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "@vitest/coverage-v8": "^4.1.5",
-    "tsx": "^4.0.0",
-    "typescript": "^5.3.0",
-    "vitest": "^4.1.5"
+    "@types/node": "^22.20.4",
+    "@vitest/coverage-v8": "^5.0.2",
+    "tsx": "^4.23.15",
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.2"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   }
 }

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.dpesch/mantisbt-mcp-server",
   "title": "MantisBT MCP Server",
   "description": "MantisBT MCP server – manage issues, notes, files, tags, and relationships. With semantic search.",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dpesch/mantisbt-mcp-server",
-      "version": "1.13.0",
+      "version": "1.14.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"