@pinepaper.studio/mcp-server 1.6.5 → 1.6.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -0
- package/manifest.json +1 -1
- package/package.json +12 -3
package/README.md
CHANGED
|
@@ -144,6 +144,17 @@ app.animate(sq, { animationType: 'rotate' });
|
|
|
144
144
|
|
|
145
145
|
The same code an agent generates is the code you can paste — the canvas is yours either way, undo included.
|
|
146
146
|
|
|
147
|
+
## What's new in 1.6.6
|
|
148
|
+
|
|
149
|
+
Dependency security, no new tools and no API changes:
|
|
150
|
+
|
|
151
|
+
- **10 vulnerable transitive pins cleared** (21 advisories: 1 critical, 13 high, 6 moderate, 1 low) across `basic-ftp`, `fast-uri`, `js-yaml`, `path-to-regexp`, `ws`, `ip-address`, `qs`, `flatted`, `body-parser` and `ajv`. Each is pinned to a floor in `overrides` so neither resolver can drift back.
|
|
152
|
+
- **Root cause was a stale committed `bun.lock`.** It pinned the vulnerable versions while `package-lock.json` had already re-resolved most of them — and `bun test`/`bun run build` install from `bun.lock`, so that was the tree in use. Both lockfiles now agree.
|
|
153
|
+
- **`npm audit` reported zero** against all of this; its registry advisory feed lags GitHub's. Verified instead with an OSV.dev sweep of both lockfiles, red-tested against the previous commit.
|
|
154
|
+
- **`manifest.json` version parity is now tested.** It had silently sat at 1.6.4 through the 1.6.5 release.
|
|
155
|
+
|
|
156
|
+
Exposure note: `puppeteer` has been an optional peer since 1.6.5, so its chain (`basic-ftp`, `ws`, `ip-address`, `js-yaml`) never reached installs of this package. The `@modelcontextprotocol/sdk` chain (`fast-uri`, `path-to-regexp`, `qs`, `body-parser`, `ajv`) is the production surface.
|
|
157
|
+
|
|
147
158
|
## What's new in 1.6.5
|
|
148
159
|
|
|
149
160
|
Security hardening, no new tools:
|
package/manifest.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"manifest_version": "0.3",
|
|
3
3
|
"name": "pinepaper-mcp",
|
|
4
|
-
"version": "1.6.
|
|
4
|
+
"version": "1.6.6",
|
|
5
5
|
"display_name": "PinePaper Studio",
|
|
6
6
|
"description": "Create animated graphics with AI using PinePaper Studio",
|
|
7
7
|
"long_description": "PinePaper MCP Server enables Claude to create, animate, and export graphics through PinePaper Studio. Features include shape creation, relation-based animations (orbits, follows, attached_to), procedural generators, visual effects, SVG export with animations, asset search & import from 4 open repositories (500k+ icons), performance metrics tracking, diagram tools for flowcharts/UML/network diagrams with smart connectors and auto-layout, enhanced error messages with canvas context, Agent Flow Mode for content automation pipelines with batch operations and smart platform exports (Instagram, TikTok, YouTube, etc.), interactive triggers (click, hover, drag events), quiz/LMS integration with SCORM/xAPI support, Letter Collage for stylized text with per-letter customization (Wordle, magazine cutout, gradient styles with 24+ palettes), and canvas presets for social media platforms. Supports two execution modes: Puppeteer (live browser execution) and Code (generate code for manual paste).",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pinepaper.studio/mcp-server",
|
|
3
|
-
"version": "1.6.
|
|
3
|
+
"version": "1.6.6",
|
|
4
4
|
"mcpName": "io.github.pinepaper/mcp-server",
|
|
5
5
|
"description": "MCP Server for PinePaper Studio - Create animated graphics with AI",
|
|
6
6
|
"type": "module",
|
|
@@ -70,7 +70,7 @@
|
|
|
70
70
|
"eslint": "^10.8.1",
|
|
71
71
|
"@typescript-eslint/eslint-plugin": "^8.66.0",
|
|
72
72
|
"@typescript-eslint/parser": "^8.66.0",
|
|
73
|
-
"puppeteer": "^24.
|
|
73
|
+
"puppeteer": "^24.43.1"
|
|
74
74
|
},
|
|
75
75
|
"files": [
|
|
76
76
|
"dist",
|
|
@@ -88,14 +88,23 @@
|
|
|
88
88
|
"README.hi.md"
|
|
89
89
|
],
|
|
90
90
|
"overrides": {
|
|
91
|
+
"basic-ftp": "^5.3.1",
|
|
92
|
+
"body-parser": "^2.3.0",
|
|
91
93
|
"es-define-property": "npm:@socketregistry/es-define-property@^1.0.7",
|
|
94
|
+
"fast-uri": "^3.1.5",
|
|
95
|
+
"flatted": "^3.4.2",
|
|
92
96
|
"function-bind": "npm:@socketregistry/function-bind@^1.0.7",
|
|
93
97
|
"gopd": "npm:@socketregistry/gopd@^1.0.7",
|
|
94
98
|
"has-symbols": "npm:@socketregistry/has-symbols@^1.0.7",
|
|
95
99
|
"hasown": "npm:@socketregistry/hasown@^1.0.7",
|
|
100
|
+
"ip-address": "^10.3.1",
|
|
101
|
+
"js-yaml": "^4.3.1",
|
|
96
102
|
"object-assign": "npm:@socketregistry/object-assign@^1.0.5",
|
|
103
|
+
"path-to-regexp": "^8.4.2",
|
|
104
|
+
"qs": "^6.15.2",
|
|
97
105
|
"safer-buffer": "npm:@socketregistry/safer-buffer@^1.0.10",
|
|
98
|
-
"side-channel": "npm:@socketregistry/side-channel@^1.0.10"
|
|
106
|
+
"side-channel": "npm:@socketregistry/side-channel@^1.0.10",
|
|
107
|
+
"ws": "^8.21.1"
|
|
99
108
|
},
|
|
100
109
|
"peerDependencies": {
|
|
101
110
|
"puppeteer": ">=22"
|