@estebanforge/pi-antigravity-bridge 1.8.3 → 1.8.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -2,7 +2,20 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file.
|
|
4
4
|
|
|
5
|
-
## [
|
|
5
|
+
## [1.8.4] - 2026-10-15
|
|
6
|
+
|
|
7
|
+
### Security
|
|
8
|
+
|
|
9
|
+
- **The MCP SDK floor now carries the OAuth credential-routing fix.**
|
|
10
|
+
`@modelcontextprotocol/sdk` 1.12.0-1.30.1 lets a malicious MCP server
|
|
11
|
+
redirect client OAuth credentials to an attacker-chosen authorization
|
|
12
|
+
server (GHSA-6qxp-vccf-f47h). The bridge runs the SDK server-side only
|
|
13
|
+
(`Server` + `StreamableHTTPServerTransport`) and never acts as an MCP
|
|
14
|
+
OAuth client, so its own exposure was nil, but the floor now points at
|
|
15
|
+
1.31.0, the first fixed version, so installs stop tripping audit. The
|
|
16
|
+
protocol-version clamp is unaffected: it rewrites any unsupported
|
|
17
|
+
`MCP-Protocol-Version` header to the SDK's own `LATEST_PROTOCOL_VERSION`,
|
|
18
|
+
whatever ceiling the new version ships. Lockfiles resolve 1.32.1.
|
|
6
19
|
|
|
7
20
|
## [1.8.3] - 2026-10-13
|
|
8
21
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@estebanforge/pi-antigravity-bridge",
|
|
3
|
-
"version": "1.8.
|
|
3
|
+
"version": "1.8.4",
|
|
4
4
|
"description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. Use antigravity/* models in Pi. Full /model picker support. Models runs Pi's tools. ToS safe to use.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"pi-package",
|
|
@@ -56,6 +56,6 @@
|
|
|
56
56
|
"dependencies": {
|
|
57
57
|
"@estebanforge/pi-ask-shared": "^0.1.2",
|
|
58
58
|
"@estebanforge/pi-tui-dialogs": "^0.1.2",
|
|
59
|
-
"@modelcontextprotocol/sdk": "^1.
|
|
59
|
+
"@modelcontextprotocol/sdk": "^1.31.0"
|
|
60
60
|
}
|
|
61
61
|
}
|