@kaminari-ad/mcp 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-06-20
+
+### Security
+
+- **Bump `undici` 8.3.0 to 8.5.0** to clear the npm-audit gate after the
+  upstream disclosure of seven high-severity advisories (TLS validation
+  bypass, shared-cache disclosure, Set-Cookie SameSite downgrade, header
+  injection, WebSocket DoS). `undici` is a direct dependency.
+
+### Added
+
+- **Security response headers on the HTTP transport.** Every HTTP
+  response now carries `Strict-Transport-Security`,
+  `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, and `Permissions-Policy`. These moved
+  off the upstream edge proxy so `mcp.kaminari.ad` is self-contained. No
+  CORS and no org-identifying headers are added (tenant-isolation rules).
+
+> `0.5.1` was tagged prematurely (before the version bump) and is
+> superseded by `0.5.2`; it was never published to npm.
+
 ## [0.5.0] - 2026-06-17
 
 ### Added

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-PG5IDZWQ.js';
+import { NAME, VERSION, err, ok } from './chunk-SQVFFWOB.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -162,10 +162,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-IJKGS6IL.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-JBLNH46R.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-N64P6LER.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-X2Y2VGBO.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-6FT6HKOB.js → chunk-3CY2WEZF.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-PG5IDZWQ.js';
+import { err, ok } from './chunk-SQVFFWOB.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -5376,5 +5376,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-6FT6HKOB.js.map
-//# sourceMappingURL=chunk-6FT6HKOB.js.map
+//# sourceMappingURL=chunk-3CY2WEZF.js.map
+//# sourceMappingURL=chunk-3CY2WEZF.js.map