@uluops/registry-mcp 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## [0.3.7] - 2026-07-27
+
+### Security
+
+- Runtime dependency tree cleared of all audit findings:
+  - `@modelcontextprotocol/sdk` `1.29.0` → `1.30.0`
+  - `hono` override `4.12.25` → `4.12.32` (the pinned override had itself
+    entered the advisory range GHSA-xgm2/GHSA-hvrm/GHSA-w62v; 4.12.27+ is fixed)
+  - `@hono/node-server` override → `2.0.12` (entire 1.x line is in the
+    GHSA-frvp-7c67-39w9 range; only used by the protocol SDK's HTTP transports —
+    this server is stdio-only — and the full suite passes under 2.x)
+  - transitive `fast-uri` + `mcp-secure-server`'s `brace-expansion` refreshed
+    via `npm audit fix`
+- Remaining audit findings are dev-tooling-only with no runtime path: the
+  brace-expansion DoS advisory (GHSA-mh99-v99m-4gvg) fanned across the
+  eslint/typescript-eslint tree (fix requires the eslint@10 major), and a
+  low-severity Windows-only esbuild dev-server advisory range-pinned by
+  tsx/vite. Accepted, revisit on the next lint-stack upgrade.
+
+### Changed
+
+- Bump `@uluops/registry-sdk` `0.46.0` → `0.47.1`: `list_models`, `get_model`,
+  and `resolve_alias` now pass through the model pricing block —
+  `cost: { input, output, cacheRead?, cacheWrite?, sourceUpdatedAt? }`, USD per
+  **million** tokens (models.dev convention). `null`/absent = unpriced; the
+  registry never fabricates `{input: 0, output: 0}` (honest-absent polarity), so
+  a rate of `0` never means "unknown". `sourceUpdatedAt` is models.dev per-model
+  entry provenance, not a cost capture date — treat rates without it as
+  provenance-unknown. Requires registry API `2026-07-26`+ (older APIs simply
+  omit the block). No handler or ToolSpec change: handlers return the SDK model
+  verbatim, and the block is ~100 bytes per model — negligible against the
+  500 KB (list) / 50 KB (get) egress caps.
+
+## [0.3.6] - 2026-07-22
+
+### Changed
+
+- Bump `@uluops/registry-sdk` `0.45.0` → `0.46.0`: `list_versions` now passes
+  through per-version author identity — `createdByName` (creator username,
+  `null` for deleted users) and `provenance` (the version's contributor
+  record). Select them via the generic `fields` meta-parameter, e.g.
+  `fields: ["version", "createdBy", "createdByName", "provenance"]`. Requires
+  registry API `2026-07-22`+ (older APIs simply omit the fields). No handler
+  or ToolSpec change: `fields` filtering is generic (tool-handler), and
+  provenance contributor records are a few hundred bytes per version —
+  negligible against the 500 KB egress cap even at the 200-version limit.
+
 ## [0.3.5] - 2026-07-18
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uluops/registry-mcp",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "MCP server for the UluOps Registry API — definition management, versioning, and analytics",
   "type": "module",
   "main": "dist/index.js",
@@ -61,8 +61,8 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@uluops/registry-sdk": "0.45.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@uluops/registry-sdk": "0.47.1",
     "@uluops/sdk-core": "0.15.0",
     "mcp-secure-server": "0.0.19-security",
     "zod": "3.25.76"
@@ -81,6 +81,7 @@
     "vitest": "4.1.8"
   },
   "overrides": {
-    "hono": "4.12.25"
+    "hono": "4.12.32",
+    "@hono/node-server": "2.0.12"
   }
 }