@thalovant/mcp-server 0.6.4 → 0.6.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.6.5 - 2026-10-23
+
+- Lock the runtime transitive dependency `ip-address` to 10.7.4, fixing the IPv6 zone-identifier parsing denial of service (CVE-2026-111997). The MCP and Thalovant SDK versions, tool schemas, and protocol behavior are unchanged.
+- Update development dependencies Vite to 8.3.3 and Vitest with its matching packages to 4.1.12, fixing CVE-2026-112942, CVE-2026-112949, and CVE-2026-112950. Neither Vite nor Vitest is included in the production OCI runtime.
+- Align `package.json`, `server.json`, the OCI label, and the README at 0.6.5. Existing release security checks and published-artifact smoke checks remain unchanged.
+
 ## 0.6.4 — 2026-10-19
 
 - **Descriptions that say what a runtime tool changes.** `thalovant_send_action`, `thalovant_send_code` and `thalovant_wait_for_event` had one-line descriptions that didn't say whether the tool changes anything. A scanner that reads only names and descriptions rated all three as high-risk tools that execute, `thalovant_wait_for_event` included, though it was already annotated `readOnlyHint: true`. `thalovant_send_action` now says the hub routes its payload like a spoken request, so a skill may act on it. `thalovant_send_code` says the hub receives its value as an exact utterance, and both say they return without waiting for a reply and that `THALOVANT_MCP_READONLY` leaves them out. `thalovant_wait_for_event` says it only listens and sends the hub nothing, and that `sessionId`, `requestId` and `context` filter which events count. `payload`, `title`, `value`, `kind`, `label` and `eventName` now have their own descriptions. Schemas, annotations and behaviour are unchanged.

package/README.md

@@ -540,7 +540,7 @@ Runtime calls sharing the same hub client identity run sequentially within one
 MCP process. Use a distinct client identity for each independently running MCP
 server so the hub can keep their sessions separate.
 
-Version 0.6.4 requires `@thalovant/sdk` `^0.9.9` (0.9.9 through versions below 0.10.0). Since 0.5.1 the server enforces
+Version 0.6.5 requires `@thalovant/sdk` `^0.9.9` (0.9.9 through versions below 0.10.0). Since 0.5.1 the server enforces
 secure effective MQTT URLs and carries a single connection deadline through
 MQTT setup and HTTP failure cleanup. Runtime tools support
 HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -74,6 +74,6 @@
   "devDependencies": {
     "@types/node": "^22.18.12",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   }
 }

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.6.4",
+  "version": "0.6.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.6.4",
+      "version": "0.6.5",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.6.4",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.6.5",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"