@withpica/mcp-sdk 1.8.0 → 1.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +10 -1
  2. package/package.json +1 -1
  3. package/.mcpregistry_github_token +0 -1
  4. package/.mcpregistry_registry_token +0 -1
package/CHANGELOG.md CHANGED
@@ -11,7 +11,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
11
11
 
12
12
  ## [Unreleased]
13
13
 
14
- ## [1.8.0] - 2026-04-21
14
+ ## [1.8.1] - 2026-04-21
15
+
16
+ ### Security
17
+
18
+ - **Re-publish of 1.8.0 under a new version after credential leak.** 1.8.0 was published at roughly 13:30 UTC 2026-04-21 and unpublished minutes later: its tarball included `.mcpregistry_github_token` and `.mcpregistry_registry_token` from the package working directory because the `.npmignore` did not exclude them and no `files` allow-list was set. Both tokens were rotated immediately; their window of exposure was the few minutes between publish and unpublish. 1.8.1 ships the same source content as 1.8.0 would have, with `.mcpregistry_*`, `*.token`, and `.env*` added to `.npmignore` as defence-in-depth. npm's rules forbid re-publishing a previously-unpublished version, hence the 1.8.0 → 1.8.1 jump with no further source changes.
19
+
20
+ ## [1.8.0] - UNPUBLISHED
21
+
22
+ Unpublished within minutes of publish on 2026-04-21 because the tarball
23
+ leaked two `.mcpregistry_*` tokens. Superseded by 1.8.1. Do not use.
15
24
 
16
25
  ### Added
17
26
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@withpica/mcp-sdk",
3
- "version": "1.8.0",
3
+ "version": "1.8.1",
4
4
  "description": "Shared PICA SDK client for MCP servers",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
package/.mcpregistry_github_token DELETED
@@ -1 +0,0 @@
1
- ghu_F7gXDttRyRGmboDUv9YQVHumFXpDy92ZFShA
package/.mcpregistry_registry_token DELETED
@@ -1 +0,0 @@
1
- {"token":"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtY3AtcmVnaXN0cnkiLCJleHAiOjE3NzY1ODUyNDQsIm5iZiI6MTc3NjU4NDk0NCwiaWF0IjoxNzc2NTg0OTQ0LCJhdXRoX21ldGhvZCI6ImdpdGh1Yi1hdCIsImF1dGhfbWV0aG9kX3N1YiI6Ikdvb2QtRk0iLCJwZXJtaXNzaW9ucyI6W3siYWN0aW9uIjoicHVibGlzaCIsInJlc291cmNlIjoiaW8uZ2l0aHViLkdvb2QtRk0vKiJ9LHsiYWN0aW9uIjoicHVibGlzaCIsInJlc291cmNlIjoiaW8uZ2l0aHViLndpdGhwaWNhLyoifV19.DbSi3xnmlgDYmWLkhnBt1rzJYEUX08hgmGpzuykPvemUTyqszSSwWvtoDuCH23znMfcPY3OpRAQ0FDVScleRBA","expires_at":1776585244}