@softspark/jira-mcp 1.4.1 → 1.4.3

package/CHANGELOG.md

@@ -7,6 +7,30 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.4.3 -- JQL Escape & Cache Recovery (2026-04-18)
+
+### Fixed
+- **`sync_tasks` default JQL parse error** -- `escapeJql` was over-escaping JQL operators (`-`, `+`, `&`, `|`, etc.) inside double-quoted string literals. Jira rejected the resulting query with `'\-' jest niedozwoloną sekwencją modyfikacji JQL`. The escape now only handles `\` and `"` (the only sequences valid inside a quoted JQL string), so `sync_tasks` works without an explicit `jql` argument when the username contains a hyphen.
+- **`reassign_task` / `update_task_status` cache miss after Jira mutation** -- both operations now recover from a cache miss by fetching the task from Jira via `connector.getIssue` and upserting it into the local cache. Previously, calling either tool right after `create_task` (cache not populated) or `log_task_time` (cache invalidated) failed with `TASK_NOT_FOUND` even though the Jira mutation succeeded.
+
+### Added
+- **`CacheManager.upsertTask(task)`** -- inserts a task or replaces it by key, tolerating a missing cache file. Used by the new mutation-recovery path.
+
+## v1.4.2 -- Supply-Chain Hardening (2026-04-18)
+
+### Added
+- **npm provenance attestation** -- `publish.yml` now publishes with `--provenance` and `id-token: write`, producing a SLSA v1 attestation on every release. Consumers can verify via `npm audit signatures` or the Provenance badge on npmjs.com.
+- **Supply-chain gates in release SOP** -- `kb/procedures/sop-release.md` adds a pre-tag check for `--provenance` and `id-token: write` in `publish.yml`, plus a post-publish step that asserts `predicateType == https://slsa.dev/provenance/v1`.
+- **Provenance verification in post-release SOP** -- `kb/procedures/sop-post-release-testing.md` adds Phase 5 covering the SLSA attestation check, `npm audit signatures`, and the npmjs.com Provenance badge.
+- **Version-sync step in pre-commit SOP** -- `kb/procedures/sop-pre-commit.md` adds Step 6 verifying `package.json` and `package-lock.json` agree on the `version` field.
+
+### Changed
+- **Release workflow permissions** -- `packages: write` and `id-token: write` added to `.github/workflows/publish.yml` for OIDC attestation.
+- **Release commit now stages the lockfile** -- SOP Phase 5 stages `package.json`, `package-lock.json`, `CHANGELOG.md`, and `README.md`. Prevents lockfile drift between tags.
+
+### Fixed
+- **`package-lock.json` top-level version drift** -- lockfile root `version` was stuck at `1.0.0` across prior releases. Regenerated via `npm install --package-lock-only` and now matches `package.json` on every release commit.
+
 ## v1.4.1 -- Template Loading Fix (2026-04-15)
 
 ### Fixed

package/README.md

@@ -4,17 +4,16 @@
 
 [![CI](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@softspark/jira-mcp)](https://www.npmjs.com/package/@softspark/jira-mcp)
-[![version](https://img.shields.io/badge/version-1.3.0-blue)](CHANGELOG.md)
+[![version](https://img.shields.io/badge/version-1.4.3-blue)](CHANGELOG.md)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 ---
 
-## What's New in v1.4.1
+## What's New in v1.4.3
 
-- **Fixed file-backed templates** -- built-in comment templates now load correctly from global npm installs (broken path resolution after bundling).
-- **`delete_task` and `delete_comment` tools** -- guarded destructive operations with ownership enforcement and explicit approval.
-- **Markdown table support** -- `markdownToAdf()` converts tables to native ADF table nodes.
-- **561 tests** across 58 test files.
+- **`sync_tasks` no longer breaks on hyphenated usernames** -- JQL escape was producing invalid `\-` sequences inside quoted strings. Default sync (without explicit `jql`) now works for every account.
+- **`update_task_status` and `reassign_task` recover from cache miss** -- after a successful Jira mutation, the cache is refreshed from the source of truth instead of failing with `TASK_NOT_FOUND`. Solves the "must re-sync after `create_task` or `log_task_time`" footgun.
+- **Provenance attestation** -- releases ship with SLSA v1 attestation via `npm publish --provenance` (introduced in v1.4.2).
 
 See [CHANGELOG.md](CHANGELOG.md) for full details.
 
@@ -257,7 +256,7 @@ src/
 
 **Typed error hierarchy** -- 20 error classes with machine-readable codes. Every tool returns structured `{ success, error, code }` responses. No stack traces leak to MCP clients.
 
-**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 558 tests across 58 test files. Self-contained 520KB package.
+**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 573 tests across 59 test files. Self-contained 525KB package.
 
 ## Documentation