@functional-systems/lambdadb-mcp 0.1.4-dev.15 → 0.1.5-dev.16

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+## [0.1.4] - 2026-10-07
+
+- Standardize feature guidance as native embedding and native reranking; pin the
+  LambdaDB TypeScript SDK to 0.8.1. Preserve public identifiers, legacy wire fields,
+  application error strings, existing behavior tests and pinned source links.
+- Update the MCP SDK to 1.31.0 for GHSA-6qxp-vccf-f47h. The advisory concerns HTTP
+  OAuth clients; this stdio server does not use the affected OAuth path.
+- Document upstream compatibility differences: the MCP SDK limits the stdio receive
+  buffer to 10 MiB and closes the transport on overflow, and formats schema
+  validation errors with field paths. Application tool names, schemas and defaults
+  remain unchanged.
+
 ## [0.1.3] - 2026-10-06
 
 - Pin the stable LambdaDB SDK to 0.8.0; expose Bayesian candidate budgets and

package/README.md

@@ -14,24 +14,23 @@ MCP server for LambdaDB using the official TypeScript MCP SDK and the official L
 Package: `@functional-systems/lambdadb-mcp`. Executable: `lambdadb-mcp`.
 Requires Node.js >=22.14.0; CI tests the minimum and current Node 22/24 LTS.
 
-The stable package is available on npm. As verified on 2026-10-06 (KST),
-`latest` resolves to `0.1.3` and `dev` to `0.1.3-dev.11`. Use an exact version for
-reproducibility or the default stable channel for initial setup. See
-[release status and policy](RELEASING.md).
-
-[MCP 0.1.3](https://github.com/lambdadb/lambdadb-mcp/releases/tag/v0.1.3) is the
-published stable release with SDK 0.8.0, Bayesian hybrid search and native
-embedding configuration, alongside native reranking and all 49 text analyzers.
-This synchronization starts the next `0.1.4-dev.1` source base; check npm for the
-current published dev version. Use exact stable version `0.1.3` for reproducible
-installed execution.
-Existing installations need an MCP version containing these changes; upgrading
+As verified on 2026-10-07 (KST), npm `latest` resolves to `0.1.4` and `dev` to
+`0.1.4-dev.15`. Use an exact version for reproducibility or the stable channel for
+initial setup. See [release status and policy](RELEASING.md).
+
+[MCP 0.1.4](https://github.com/lambdadb/lambdadb-mcp/releases/tag/v0.1.4) is published
+with LambdaDB SDK `0.8.1`, native embedding and native reranking terminology, and
+MCP SDK `1.31.0`. The MCP SDK update includes a 10 MiB stdio receive-buffer limit
+and revised schema-validation error formatting. Existing tool names, wire fields
+and read-only defaults remain unchanged. This checkout starts the next
+`0.1.5-dev.1` source base; check npm for the current published dev version.
+Existing installations need an MCP release containing these changes; upgrading
 the SDK separately does not update them.
 
 ```sh
 npx --yes @functional-systems/lambdadb-mcp
 # Pin the stable release:
-npx --yes @functional-systems/lambdadb-mcp@0.1.3
+npx --yes @functional-systems/lambdadb-mcp@0.1.4
 # Or install globally:
 npm install -g @functional-systems/lambdadb-mcp
 lambdadb-mcp

package/RELEASING.md

@@ -1,6 +1,31 @@
 # Releasing LambdaDB MCP
 
-## Current stable release: 0.1.3 (2026-10-06 KST)
+## Current stable release: 0.1.4 (2026-10-07 KST)
+
+[v0.1.4](https://github.com/lambdadb/lambdadb-mcp/releases/tag/v0.1.4) tags main
+commit `f84038962bbdc6f5375b873727d0cf54d843c7b2`, which merged
+[release PR #21](https://github.com/lambdadb/lambdadb-mcp/pull/21) with an explicitly
+authorized administrator merge and preserved ancestry. The
+[release workflow](https://github.com/lambdadb/lambdadb-mcp/actions/runs/37600343928)
+passed Node 22.14.0 / 22 / 24 validation and published its exact tested artifact
+with OIDC and provenance. Registry snapshot: `latest=0.1.4`, `dev=0.1.4-dev.15`.
+
+LambdaDB SDK 0.8.1 standardizes native embedding and native reranking terminology.
+MCP SDK 1.31.0 addresses the OAuth-client advisory; its stdio receive-buffer limit
+is 10 MiB and schema-validation error formatting includes field paths. Existing
+application tool contracts remain. The downloaded stable artifact matched its
+registry integrity, source commit and both SDK pins, passed 35 installed-package
+tests, and had zero consumer audit vulnerabilities. Provenance statement metadata
+matched the release source and artifact. No new paid/state-changing live smoke
+was run. See [validation evidence](docs/validation/2026-10-07-0.1.4.md).
+Do not repeat publication or move the tag.
+
+`release/sync-0.1.4` brings main back into develop with the next source base
+`0.1.5-dev.1`. Review it into develop using a merge commit to preserve ancestry.
+Eligible develop merges can publish new dev versions while `latest` stays on
+0.1.4. Do not merge stable version metadata directly into develop.
+
+## Previous stable release: 0.1.3 (2026-10-06 KST)
 
 [v0.1.3](https://github.com/lambdadb/lambdadb-mcp/releases/tag/v0.1.3) tags main
 commit `159b84aace7d9352cf8e5315bc7f7192e8d65a41`, which merged

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@functional-systems/lambdadb-mcp",
-  "version": "0.1.4-dev.15",
+  "version": "0.1.5-dev.16",
   "private": false,
   "description": "MCP server for LambdaDB data plane",
   "type": "module",
@@ -62,5 +62,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
-  "gitHead": "752fd825480556305f2a89025a0d87f5126b4d1b"
+  "gitHead": "27f128b9edbde67dde7624c7bd29d4fcc8cbf9dd"
 }