@page2ai/mcp 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,31 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html); while the
 major version is `0`, a minor bump may carry breaking changes.
 
+## 0.4.0 - 2026-10-18
+
+### Security
+- **`@page2ai/core` 0.3.0: SSRF guard hardening (BL-22).** DNS pinning closes the rebinding
+  window where `fetch()` could re-resolve a hostname to an internal address between the guard's
+  check and the connect. Extended blocklists cover multicast, broadcast, TEST-NET, NAT64, 6to4,
+  Teredo, documentation and discard IPv6 ranges. `undici` added as a transitive dependency through
+  core (zero transitive deps of its own). Core engines raised from >=18.0 to >=18.17 (mcp stays
+  >=20.0, unaffected).
+
+## 0.3.2 - 2026-10-17
+
+### Fixed
+- **`@page2ai/core` 0.2.2: the review fix for 0.2.1's button rule** (P2A-019), and the dependency range starts there
+  (`^0.2.2`, was `^0.2.1`). A page with thousands of sibling buttons converts in tens of milliseconds again (core
+  0.2.1 took 1.0 to 5.7 s for 3,000 sibling buttons, measured on 2026-10-18), and the page text 0.2.1 left out
+  comes back: an accordion's question with neither `aria-expanded` nor a heading (the session titles of a
+  W3Schools-style accordion), a definition
+  term, a question under `role="heading"`, a link written inside a button, and a command whose button is named «Copy
+  command: <command>» (core CHANGELOG, 0.2.2). The range moves for the reason given under 0.3.1: measured again on
+  2026-10-18, with core 0.2.2 out, an `npx` cache filled before it still ran `page2ai-mcp` 0.3.1 on core 0.2.1, and an
+  empty cache ran core 0.2.2.
+- README: the example output stays as captured on core 0.2.1: on 2026-10-18 core 0.2.2 converted that page byte for
+  byte as 0.2.1 did, without the front matter.
+
 ## 0.3.1 - 2026-10-17
 
 ### Fixed

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "page2ai-mcp",
   "display_name": "Page2AI — Web to Markdown",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Convert any web page to clean Markdown for LLM context",
   "long_description": "Page2AI MCP converts a web page URL to Markdown for AI context windows. It keeps the page's main content (its <main> or dominant <article>), preserves code blocks with language hints, converts tables and lists, and drops navigation, headers, footers and sidebars. The only network requests go to the URL you pass it and the addresses it redirects to, asked for as a browser opens a page, so docs platforms return the page itself rather than a Markdown copy of it: pure Node + linkedom, no browser, no cookies, no page scripts, no external services, no telemetry. A page behind a sign-in, or one rendered only by JavaScript, is therefore out of its reach.\n\nCompanion to the Page2AI browser extension (https://github.com/igorsaevets/page2ai-extension), which converts the live page in your own browser, including pages behind a sign-in. Built on the open-source @page2ai/core library.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@page2ai/mcp",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "mcpName": "io.github.igorsaevets/page2ai-mcp",
   "description": "MCP server that converts any web page URL to clean Markdown for LLM context. Processing is local and SSRF-guarded; no external APIs, no telemetry.",
   "type": "module",
@@ -35,13 +35,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.0.0",
-    "@page2ai/core": "^0.2.1",
+    "@page2ai/core": "^0.3.0",
     "zod": "^4.2.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.5"
   },
   "keywords": [
     "mcp",

package/server.json

@@ -8,12 +8,12 @@
     "source": "github"
   },
   "websiteUrl": "https://github.com/igorsaevets/page2ai-mcp#readme",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@page2ai/mcp",
-      "version": "0.3.1",
+      "version": "0.4.0",
       "transport": {
         "type": "stdio"
       }