@uteamup/mcp-server 2.6.4-beta.9 → 2.6.6-beta.9

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.6.6-beta.9](https://github.com/UteamUP/uteamup-mcp/compare/2.6.5-beta.9...2.6.6-beta.9) (2026-11-04)
+
+
+### Bug Fixes
+
+* bound MCP OAuth refresh requests ([f7a6c8e](https://github.com/UteamUP/uteamup-mcp/commit/f7a6c8ee13b9f0e5910cc7c13213c12afc9ad129))
+
+
+### Tests
+
+* preserve exact hardware filters in physical identity tool forwarding ([149ea28](https://github.com/UteamUP/uteamup-mcp/commit/149ea288dfd74b0ae8a2dd448a4a874c73ab2554))
+
+## [2.6.5-beta.9](https://github.com/UteamUP/uteamup-mcp/compare/2.6.4-beta.9...2.6.5-beta.9) (2026-11-03)
+
+
+### Bug Fixes
+
+* document npm trust CLI setup and web authentication ([6ec031b](https://github.com/UteamUP/uteamup-mcp/commit/6ec031b7544a3d6fc9c6cffeaa953c58fbcde30b))
+* document required npm OIDC publisher permissions ([4df22e9](https://github.com/UteamUP/uteamup-mcp/commit/4df22e9d5eb87b56f97f5328f5db0e6215c31b2e))
+
+
+### Tests
+
+* cover reviewed component tool contracts ([8cd7727](https://github.com/UteamUP/uteamup-mcp/commit/8cd772777213502bac3743c0b144838b2454ef9d))
+* cover reviewed IoT component identity tools ([b316ec5](https://github.com/UteamUP/uteamup-mcp/commit/b316ec5a89d1af46e2a1fd805a98c109887da6f0))
+* pin the served component MCP tool names ([08e0cb2](https://github.com/UteamUP/uteamup-mcp/commit/08e0cb2c803b975aae64f252a0e312a43a256a54))
+* use a valid declared hardware identity namespace ([348ec6b](https://github.com/UteamUP/uteamup-mcp/commit/348ec6b1f295bde43171999a7f41fb721c851053))
+
 ## [2.6.4-beta.9](https://github.com/UteamUP/uteamup-mcp/compare/2.6.3-beta.9...2.6.4-beta.9) (2026-11-03)
 
 

package/index.js

@@ -23,6 +23,7 @@ const { buildMcpForwardHeaders } = require('./lib/mcp-http-headers');
 const {
   BoundedLineBuffer,
   ProxyTransportError,
+  attachRequestDeadline,
   attachRequestTimeout,
   collectResponseBody,
   getMcpRetryLimit,
@@ -267,6 +268,7 @@ async function requestNewAccessToken() {
             }
           });
           authRequest.once('error', reject);
+          attachRequestDeadline(authRequest, 'OAuth authorization request', config.requestTimeout, reject);
           attachRequestTimeout(authRequest, 'OAuth authorization request');
         });
       },
@@ -335,6 +337,7 @@ async function requestNewAccessToken() {
           });
 
           req.once('error', reject);
+          attachRequestDeadline(req, 'OAuth token request', config.requestTimeout, reject);
           attachRequestTimeout(req, 'OAuth token request');
           req.write(tokenData);
           req.end();

package/lib/transport-security.js

@@ -230,6 +230,22 @@ function attachRequestTimeout(request, label) {
   });
 }
 
+/**
+ * Bound the entire request, including connection setup and a response that keeps sending data.
+ * @param {import('node:http').ClientRequest} request
+ * @param {string} label
+ * @param {number} timeoutMs
+ * @param {(error: ProxyTransportError) => void} reject
+ */
+function attachRequestDeadline(request, label, timeoutMs, reject) {
+  const timer = setTimeout(() => {
+    reject(new ProxyTransportError(`${label} timed out after ${timeoutMs} ms`));
+    request.destroy();
+  }, timeoutMs);
+  timer.unref();
+  request.once('close', () => clearTimeout(timer));
+}
+
 /**
  * @param {unknown} error
  * @returns {string}
@@ -243,6 +259,7 @@ function toPublicErrorMessage(error) {
 module.exports = {
   BoundedLineBuffer,
   ProxyTransportError,
+  attachRequestDeadline,
   attachRequestTimeout,
   collectResponseBody,
   getMcpRetryLimit,

package/openapi-actions.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "UteamUP CMMS Read-Only Assistant Actions",
     "description": "OpenAPI 3.1.0 Action schema for ChatGPT Custom GPTs (GPT Store) and Google Gemini / Vertex AI Extensions. Invokes the UteamUP read-only MCP endpoint (/mcp/read-only) to list and search assets and work orders using the caller's tenant-scoped permissions.",
-    "version": "2.6.4-beta.9",
+    "version": "2.6.6-beta.9",
     "x-logo": {
       "url": "https://raw.githubusercontent.com/UteamUP/uteamup-mcp/main/assets/logo.png",
       "altText": "UteamUP CMMS"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uteamup/mcp-server",
-  "version": "2.6.4-beta.9",
+  "version": "2.6.6-beta.9",
   "mcpName": "io.github.UteamUP/mcp-server",
   "description": "MCP server client for UteamUP - enables Claude Desktop/Code integration with automatic OAuth 2.0 authentication",
   "main": "index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.UteamUP/mcp-server",
   "title": "UteamUP CMMS",
   "description": "Connect AI assistants to UteamUP CMMS for work orders, assets, maintenance, and inventory.",
-  "version": "2.6.4-beta.9",
+  "version": "2.6.6-beta.9",
   "websiteUrl": "https://uteamup.com",
   "icons": [
     {
@@ -30,7 +30,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@uteamup/mcp-server",
-      "version": "2.6.4-beta.9",
+      "version": "2.6.6-beta.9",
       "transport": {
         "type": "stdio"
       },