@functional-systems/lambdadb-mcp 0.1.5-dev.17 → 0.1.5

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## [0.1.5] - 2026-10-25
+
+- Pin MCP SDK 1.32.2, raise the Zod minimum to 4.6.7, and refresh the affected
+  transitive dependencies to clear six npm audit findings. Keep the LambdaDB
+  SDK, Node.js floor, tool schemas and read-only defaults unchanged. The new SDK
+  input-element cap remains unset; omitted tool arguments now behave as an empty
+  object while required inputs still fail validation.
+
 - Replace the query tool's top-level `allOf` with equivalent conditionals so
   Claude through Kiro/Bedrock can accept the tool inventory. Preserve facet and
   rerank schema constraints, runtime validation and read-only defaults.

package/CONTRIBUTING.md

@@ -8,7 +8,7 @@ changes outside the PR. Use a dedicated worktree when another checkout is in use
 
 Use Node.js 22.14.0 or newer. CI verifies the exact minimum 22.14.0 and current
 22.x and 24.x LTS releases. Node 20 is end-of-life and is no longer supported.
-The runtime dependencies permit older Node versions (MCP SDK 1.31.0 declares
+The runtime dependencies permit older Node versions (MCP SDK 1.32.2 declares
 Node >=18), but that is not a promise to support end-of-life runtimes. The
 22.14.0 floor also aligns with the CLI and npm's OIDC publishing runtime floor.
 See the [Node release schedule](https://nodejs.org/en/about/previous-releases)

package/README.md

@@ -14,19 +14,28 @@ MCP server for LambdaDB using the official TypeScript MCP SDK and the official L
 Package: `@functional-systems/lambdadb-mcp`. Executable: `lambdadb-mcp`.
 Requires Node.js >=22.14.0; CI tests the minimum and current Node 22/24 LTS.
 
-As verified on 2026-10-07 (KST), npm `latest` resolves to `0.1.4` and `dev` to
-`0.1.4-dev.15`. Use an exact version for reproducibility or the stable channel for
+As verified on 2026-10-25 (KST), npm `latest` resolves to `0.1.4`. This checkout
+prepares `0.1.5`; it is not yet published. The `dev` channel advances separately.
+Use an exact published version for reproducibility or the stable channel for
 initial setup. See [release status and policy](RELEASING.md).
 
 [MCP 0.1.4](https://github.com/lambdadb/lambdadb-mcp/releases/tag/v0.1.4) is published
 with LambdaDB SDK `0.8.1`, native embedding and native reranking terminology, and
 MCP SDK `1.31.0`. The MCP SDK update includes a 10 MiB stdio receive-buffer limit
 and revised schema-validation error formatting. Existing tool names, wire fields
-and read-only defaults remain unchanged. This checkout starts the next
-`0.1.5-dev.1` source base; check npm for the current published dev version.
+and read-only defaults remain unchanged.
 Existing installations need an MCP release containing these changes; upgrading
 the SDK separately does not update them.
 
+This checkout pins MCP SDK `1.32.2` and requires Zod `^4.6.7`, with patched
+transitive dependencies in the lockfile. It replaces the query tool's top-level
+`allOf` with equivalent conditionals for Kiro/Claude compatibility. The SDK now treats omitted tool
+arguments as an empty object; required inputs still fail validation. Its new
+`maxToolInputElements` option remains unset, preserving existing input limits.
+Upstream HTTP redirect/authentication and experimental-task fixes do not add
+those features to this stdio-only server. See the
+[upstream upgrade notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0).
+
 ```sh
 npx --yes @functional-systems/lambdadb-mcp
 # Pin the stable release:

package/RELEASING.md

@@ -1,5 +1,26 @@
 # Releasing LambdaDB MCP
 
+## Prepared stable candidate: 0.1.5 (2026-10-25 KST)
+
+The `release/0.1.5` branch promotes reviewed develop commit
+`bf4536f5a8256a4193e8dcea86f1ecedc626294d`, including
+[Kiro schema PR #25](https://github.com/lambdadb/lambdadb-mcp/pull/25) and
+[dependency PR #26](https://github.com/lambdadb/lambdadb-mcp/pull/26), into main.
+Candidate-only changes are package/lock versions and release documentation;
+application source, tests, dependencies and CI match that reviewed source.
+See the [candidate validation record](docs/validation/2026-10-25-0.1.5.md).
+
+As checked on 2026-10-25 (KST), `latest` remains 0.1.4 and no `v0.1.5` tag
+exists. Candidate validation does not publish a package. After review, merge into
+main while preserving ancestry, then obtain explicit authorization before
+creating the annotated `v0.1.5` tag and publishing its non-prerelease GitHub
+Release. The release workflow must test and publish its exact artifact; verify
+registry identity, integrity, provenance and clean-consumer behavior afterward.
+
+The LambdaDB CLI still pins MCP 0.1.4. Stable CLI users receive this fix only
+after a separate CLI pin update and release. After MCP publication, synchronize
+main back into develop with the next dev base through a PR.
+
 ## Current stable release: 0.1.4 (2026-10-07 KST)
 
 [v0.1.4](https://github.com/lambdadb/lambdadb-mcp/releases/tag/v0.1.4) tags main
@@ -20,8 +41,9 @@ matched the release source and artifact. No new paid/state-changing live smoke
 was run. See [validation evidence](docs/validation/2026-10-07-0.1.4.md).
 Do not repeat publication or move the tag.
 
-`release/sync-0.1.4` brings main back into develop with the next source base
-`0.1.5-dev.1`. Review it into develop using a merge commit to preserve ancestry.
+The 0.1.4 synchronization completed in
+[PR #22](https://github.com/lambdadb/lambdadb-mcp/pull/22), bringing main back into
+develop with the next source base `0.1.5-dev.1` and preserved ancestry.
 Eligible develop merges can publish new dev versions while `latest` stays on
 0.1.4. Do not merge stable version metadata directly into develop.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@functional-systems/lambdadb-mcp",
-  "version": "0.1.5-dev.17",
+  "version": "0.1.5",
   "private": false,
   "description": "MCP server for LambdaDB data plane",
   "type": "module",
@@ -25,8 +25,8 @@
   },
   "dependencies": {
     "@functional-systems/lambdadb": "0.8.1",
-    "@modelcontextprotocol/sdk": "1.31.0",
-    "zod": "^4.1.12"
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^22.12.0",
@@ -62,5 +62,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
-  "gitHead": "f56d2bb7705588ec7e9b6fe3668e72cbf2db5315"
+  "gitHead": "1ae40dcbebea734e34ddde024e0991c8bf3fda64"
 }