@page2ai/mcp 0.3.2 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,16 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html); while the
 major version is `0`, a minor bump may carry breaking changes.
 
+## 0.4.0 - 2026-10-18
+
+### Security
+- **`@page2ai/core` 0.3.0: SSRF guard hardening (BL-22).** DNS pinning closes the rebinding
+  window where `fetch()` could re-resolve a hostname to an internal address between the guard's
+  check and the connect. Extended blocklists cover multicast, broadcast, TEST-NET, NAT64, 6to4,
+  Teredo, documentation and discard IPv6 ranges. `undici` added as a transitive dependency through
+  core (zero transitive deps of its own). Core engines raised from >=18.0 to >=18.17 (mcp stays
+  >=20.0, unaffected).
+
 ## 0.3.2 - 2026-10-17
 
 ### Fixed

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "page2ai-mcp",
   "display_name": "Page2AI — Web to Markdown",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Convert any web page to clean Markdown for LLM context",
   "long_description": "Page2AI MCP converts a web page URL to Markdown for AI context windows. It keeps the page's main content (its <main> or dominant <article>), preserves code blocks with language hints, converts tables and lists, and drops navigation, headers, footers and sidebars. The only network requests go to the URL you pass it and the addresses it redirects to, asked for as a browser opens a page, so docs platforms return the page itself rather than a Markdown copy of it: pure Node + linkedom, no browser, no cookies, no page scripts, no external services, no telemetry. A page behind a sign-in, or one rendered only by JavaScript, is therefore out of its reach.\n\nCompanion to the Page2AI browser extension (https://github.com/igorsaevets/page2ai-extension), which converts the live page in your own browser, including pages behind a sign-in. Built on the open-source @page2ai/core library.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@page2ai/mcp",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "mcpName": "io.github.igorsaevets/page2ai-mcp",
   "description": "MCP server that converts any web page URL to clean Markdown for LLM context. Processing is local and SSRF-guarded; no external APIs, no telemetry.",
   "type": "module",
@@ -35,13 +35,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.0.0",
-    "@page2ai/core": "^0.2.2",
+    "@page2ai/core": "^0.3.0",
     "zod": "^4.2.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.5"
   },
   "keywords": [
     "mcp",

package/server.json

@@ -8,12 +8,12 @@
     "source": "github"
   },
   "websiteUrl": "https://github.com/igorsaevets/page2ai-mcp#readme",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@page2ai/mcp",
-      "version": "0.3.2",
+      "version": "0.4.0",
       "transport": {
         "type": "stdio"
       }