@thalovant/mcp-server 0.6.4 → 0.6.6

package/CHANGELOG.md

@@ -1,5 +1,20 @@
+Last Edit: Codex (exact runtime model identifier unavailable) - 2026-10-25 - Motive: Document the scoped dependency security patch.
+
 # Changelog
 
+## 0.6.6 - Unreleased
+
+- Update body-parser to 2.4.0 (CVE-2026-111181), Zod to 4.6.7 (patched bounds checks from 4.6.6), and the existing fast-uri override to 3.1.9. No audit suppression is added.
+- Migrate five records to Zod 4's explicit string-key signature. Bounded arrays reject oversized input before parsing elements. UUIDs now enforce standard version/variant bits (plus nil/max UUIDs); memory-list offsets reject unsafe integers.
+- Preserve the 50 default tools, Thalovant SDK version, permissions and transport behavior. Zod 4's generated input schemas inline repeated records, add string property names and omit the previous `additionalProperties: false` on stripping objects; unknown input keys remain stripped at runtime.
+- Align package, registry and OCI metadata at 0.6.6. Publication, published-artifact smoke checks and deployment remain separate release steps.
+
+## 0.6.5 - 2026-10-23
+
+- Lock the runtime transitive dependency `ip-address` to 10.7.4, fixing the IPv6 zone-identifier parsing denial of service (CVE-2026-111997). The MCP and Thalovant SDK versions, tool schemas, and protocol behavior are unchanged.
+- Update development dependencies Vite to 8.3.3 and Vitest with its matching packages to 4.1.12, fixing CVE-2026-112942, CVE-2026-112949, and CVE-2026-112950. Neither Vite nor Vitest is included in the production OCI runtime.
+- Align `package.json`, `server.json`, the OCI label, and the README at 0.6.5. Existing release security checks and published-artifact smoke checks remain unchanged.
+
 ## 0.6.4 — 2026-10-19
 
 - **Descriptions that say what a runtime tool changes.** `thalovant_send_action`, `thalovant_send_code` and `thalovant_wait_for_event` had one-line descriptions that didn't say whether the tool changes anything. A scanner that reads only names and descriptions rated all three as high-risk tools that execute, `thalovant_wait_for_event` included, though it was already annotated `readOnlyHint: true`. `thalovant_send_action` now says the hub routes its payload like a spoken request, so a skill may act on it. `thalovant_send_code` says the hub receives its value as an exact utterance, and both say they return without waiting for a reply and that `THALOVANT_MCP_READONLY` leaves them out. `thalovant_wait_for_event` says it only listens and sends the hub nothing, and that `sessionId`, `requestId` and `context` filter which events count. `payload`, `title`, `value`, `kind`, `label` and `eventName` now have their own descriptions. Schemas, annotations and behaviour are unchanged.

package/README.md

@@ -1,3 +1,5 @@
+Last Edit: Codex (exact runtime model identifier unavailable) - 2026-10-25 - Motive: Record security dependency compatibility and the next patch version.
+
 # Thalovant MCP Server
 
 [![M8ven Live Monitored](https://m8ven.ai/badge/mcp/thalovant-thalovant-mcp-1cyhb4)](https://m8ven.ai/mcp/thalovant-thalovant-mcp-1cyhb4)
@@ -540,13 +542,15 @@ Runtime calls sharing the same hub client identity run sequentially within one
 MCP process. Use a distinct client identity for each independently running MCP
 server so the hub can keep their sessions separate.
 
-Version 0.6.4 requires `@thalovant/sdk` `^0.9.9` (0.9.9 through versions below 0.10.0). Since 0.5.1 the server enforces
+Version 0.6.6 requires `@thalovant/sdk` `^0.9.9` (0.9.9 through versions below 0.10.0). Since 0.5.1 the server enforces
 secure effective MQTT URLs and carries a single connection deadline through
 MQTT setup and HTTP failure cleanup. Runtime tools support
 HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`
 reports readiness only after authentication; a reachable hub or broker alone
 does not establish a runtime session.
 
+The Zod 4 security migration preserves the 50 default tools and string-keyed record values. Its JSON Schema output inlines repeated records, identifies string property names, and omits `additionalProperties: false` on stripping objects; unknown input keys are still stripped before handlers receive them. UUID validation now enforces standard version/variant bits (plus nil/max UUIDs), and memory-list offsets must be safe integers. See the [security audit](https://github.com/thalovant/thalovant-mcp/blob/main/AUDIT.md) for evidence and release gates.
+
 Keep the SDK configuration directory persistent and private between server
 restarts (`~/.config/thalovant`, or the configured XDG/Windows equivalent). It
 contains the client Noise key and trusted server pins. An authentication

package/dist/index.js

@@ -75,7 +75,7 @@ const publicHubsLimitSchema = z
     .default(25)
     .describe("Page size, 1-48. The public hubs endpoint caps page size at 48.");
 const optionalCursorSchema = z.string().min(1).optional();
-const jsonRecordSchema = z.record(z.unknown());
+const jsonRecordSchema = z.record(z.string(), z.unknown());
 const controlPlaneSchema = {
     loginScope: z
         .string()
@@ -197,8 +197,8 @@ const hubEtagSchema = z
     .describe("Required. The hub's current etag, sent as If-Match for optimistic locking. Read it from the `etag` field in the hub resource BODY returned by thalovant_get_hub — the API does not send an ETag response header, so you must fetch the hub first. A missing or stale value fails with HTTP 412 and changes nothing: re-fetch the hub, take the new etag, and retry.");
 const runtimeGroupResourceLimitsSchema = z
     .object({
-    requests: z.record(z.string()).optional(),
-    limits: z.record(z.string()).optional(),
+    requests: z.record(z.string(), z.string()).optional(),
+    limits: z.record(z.string(), z.string()).optional(),
 })
     .optional();
 const runtimeGroupSpecSchema = z
@@ -217,7 +217,7 @@ const releaseOptionsSchema = {
     channel: z.string().min(1).optional().describe("Release channel. Falls back to the workspace release policy when omitted."),
     mode: z.string().min(1).optional().describe('Release mode. Passing images without mode switches to "custom".'),
     version: z.string().min(1).optional().describe("Pinned release version."),
-    images: z.record(z.string().min(1)).optional().describe("Explicit image overrides. Switches to custom mode unless mode is also set. Non-admins may pass only images the platform releases for each key: a catalog pin of the stable or alpha channel, the resource's current, recommended or release-policy image, or the platform's default image; runtime core also accepts any tag or digest of ghcr.io/thalovant/ovos-core and hub listener any tag or digest of ghcr.io/thalovant/hivemind-listener, while bus and preview_bridge take only the listed images. Anything else fails with 403 platform_image_required, whose error lists allowed_images and allowed_repositories per refused key."),
+    images: z.record(z.string(), z.string().min(1)).optional().describe("Explicit image overrides. Switches to custom mode unless mode is also set. Non-admins may pass only images the platform releases for each key: a catalog pin of the stable or alpha channel, the resource's current, recommended or release-policy image, or the platform's default image; runtime core also accepts any tag or digest of ghcr.io/thalovant/ovos-core and hub listener any tag or digest of ghcr.io/thalovant/hivemind-listener, while bus and preview_bridge take only the listed images. Anything else fails with 403 platform_image_required, whose error lists allowed_images and allowed_repositories per refused key."),
     reason: z.string().min(1).optional().describe("Audit reason recorded with the release."),
 };
 function releaseOptionsFrom(args) {
@@ -1620,7 +1620,7 @@ export function createServer() {
             languages: z.array(z.string().trim().min(1).max(100)).min(1).max(20).default(["en-us"]),
             speakable: z.boolean().default(false).describe("Render intent patterns with locale slot examples; preserve complete-phrase priority."),
             sentence: z.boolean().default(false).describe("Capitalize and punctuate examples using the selected locale. Implies speakable rendering."),
-            slots: z.record(z.string().max(500)).optional().describe("Example values for named intent slots."),
+            slots: z.record(z.string(), z.string().max(500)).optional().describe("Example values for named intent slots."),
             exampleLimit: z.number().int().min(1).max(20).default(2),
             describe: z.boolean().default(true),
             fallback: z.boolean().default(true).describe("Try engine manifests if the intent listing is refused or unanswered."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -66,14 +66,14 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@thalovant/sdk": "^0.9.9",
     "jose": "^6.2.8",
-    "zod": "^3.25.76"
+    "zod": "^4.6.6"
   },
   "overrides": {
-    "fast-uri": "3.1.8"
+    "fast-uri": "3.1.9"
   },
   "devDependencies": {
     "@types/node": "^22.18.12",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   }
 }

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.6.4",
+  "version": "0.6.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.6.4",
+      "version": "0.6.6",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.6.4",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.6.6",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"