@respira/wordpress-mcp-server 8.2.8 → 8.2.9

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to Respira WordPress MCP Server will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.2.9] - 2026-08-12
+
+### Fixed
+
+- **The security tool descriptions named an advisory that had moved on.** `wordpress_update_core_security` described its `advisory_id` as "currently wordpress-wp2shell-2026" and listed 6.8.6 / 6.9.5 / 7.0.2 as the targets. The plugin catalog has carried the August 2026 core security release and its backports down to 4.7.34 since 8.6.9, and neither field was ever an enum, so nothing was blocked. Only the description was out of date, and that was enough: an agent read it, concluded the tool could not handle the August advisory, and stopped before trying. Both fields now point at `wordpress_run_security_audit` and the catalog rather than naming an advisory, so a future security release cannot make them wrong again. `advisory_ids` on the audit also now says what it actually does, which is get recorded on the receipt without changing which indicators the audit looks for.
+
 ## [8.2.8] - 2026-08-11
 
 ### Fixed

package/dist/server.js

@@ -3580,7 +3580,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         advisory_ids: {
                             type: 'array',
                             items: { type: 'string' },
-                            description: 'Optional reviewed advisory IDs to record as the audit scope, for example wordpress-wp2shell-2026.',
+                            description: 'Optional reviewed advisory IDs, recorded on the receipt as the scope you audited. Recorded only: this does not currently change which indicators the audit looks for.',
                         },
                         deep_scan: {
                             type: 'boolean',
@@ -3599,11 +3599,11 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     properties: {
                         advisory_id: {
                             type: 'string',
-                            description: 'Reviewed security advisory ID, currently wordpress-wp2shell-2026.',
+                            description: 'Reviewed security advisory ID. Do not guess it: run respira_run_security_audit first and use the advisory it reports. The approved list lives in the plugin catalog and grows with each WordPress security release, so any advisory named here would go stale.',
                         },
                         target_version: {
                             type: 'string',
-                            description: 'Exact approved patch version on the current branch: 6.8.6, 6.9.5 or 7.0.2 for wp2shell.',
+                            description: 'Exact approved patch version for that advisory on this site\'s own release branch, as reported by respira_run_security_audit. The plugin rejects anything outside its catalog, and it will not move a site across branches.',
                         },
                         backup_confirmed: {
                             type: 'boolean',