ast-mcp-server 0.14.0 → 0.14.2

package/CHANGELOG.md

@@ -6,7 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.14.0] — not yet published (2026-10-25)
+## [0.14.2] — not yet published (2026-10-28)
+
+### Security
+
+- Updated `qs` to the patched `6.16.1` (GHSA-6pq8-jhm2-2vcw, `qs.stringify` with `arrayFormat: 'comma'` could throw an uncaught `TypeError`). `qs` reaches the server through `express` and `body-parser`, and the pinned resolution moved from `6.16.0`.
+
+### Changed
+
+- Updated runtime dependencies: `ts-morph` from `24.0.0` to `28.0.0`, `@toon-format/toon` from `4.1.0` to `4.4.0`, and `@modelcontextprotocol/sdk` from `1.32.1` to `1.32.2` in the lockfile.
+- Updated development tooling: Vitest 5 (now with an explicit `vite` development dependency), `@types/node` 26, `gpt-tokenizer` 4, and patch updates to ESLint, Prettier, `typescript-eslint` and `yaml`. `process.disconnect` is now called optionally in the compiler worker entry to match the stricter Node 26 typings.
+- Updated reviewed GitHub Actions pins (`actions/setup-node` 7.1.0, `actions/upload-artifact` 7.0.2, `actions/download-artifact` 8.0.2, `github/codeql-action` 4.39.1), including the release workflow.
+
+## [0.14.1] — published to `latest` and `next`, registry verified (2026-10-26)
+
+### Security
+
+- Deduplicated `zod` in the lockfile to the patched `4.6.7` (GHSA-mrhx-c7xc-m3w5). The `@modelcontextprotocol/sdk` range `^3.25 || ^4.0` had kept a second, vulnerable `4.4.3` copy beside the direct dependency; `yarn audit` did not report it. No runtime code or advertised tool contract changes.
+
+### Release status
+
+- npm published immutable `0.14.1` bytes with integrity `sha512-Z9a0rXsYYf+Eef8XCoA6qrId1puqiq3nFjsb5FP165OsvRr666MdL9N66/RmHXb/Uu7ynoVZ9X2ZqGSHED4H5A==`. Public-registry verification passed; `latest` and `next` both resolve to `0.14.1`; and npm `gitHead`, the annotated `v0.14.1` tag, and the GitHub Release target exact commit `f37f398b083135f0f65a265c8aca26d9edc5c74d`.
+- Publish run `40377206195` reported its readback as ambiguous because of registry lag although npm accepted the version (it appeared about 40 seconds later); verification `40387042272` and promotion `40387852805` are green and authoritative.
+
+## [0.14.0] — published to `latest` and `next`, registry verified (2026-10-25)
 
 ### Changed
 
@@ -16,6 +39,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Upgraded `@modelcontextprotocol/sdk` to `^1.32.1` (GHSA-6qxp-vccf-f47h), `body-parser` to 2.4.0, and `zod` to 4.6.7 for the memory-exhaustion advisory, and raised the `hono` and `fast-uri` resolutions to 4.13.13 and 3.1.9. `yarn audit` reports no suggestions.
 
+### Release status
+
+- npm published immutable `0.14.0` bytes with integrity `sha512-+g1GpmB9ZMd4tB/z7o75AZ4LdnqEn+MQDiRh0LDBV2j4xb9iKB8XMoiME47tW0u2HgfxWsKtQBChGxfnrz3dVw==`. Public-registry verification passed; `latest` and `next` both resolve to `0.14.0`; and npm `gitHead`, the annotated `v0.14.0` tag, and the GitHub Release target exact commit `f6e64751398f69eb3f0f1abc808f4221f7d2bc52`.
+- Publish run `40232707904` reported its readback as ambiguous because of registry lag although npm had accepted the version; verification `40249874010` and promotion `40255528749` are green and authoritative.
+
 ## [0.13.1] — published to `latest` and `next`, registry verified (2026-09-01)
 
 ### Fixed

package/README.md

@@ -353,7 +353,7 @@ For a local candidate, pack and install its tarball instead:
 
 ```bash
 yarn pack --out ast-mcp-server-%v.tgz
-dsh plugin --profile web add ./ast-mcp-server-0.14.0.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.14.2.tgz
 ```
 
 The first supported surface is **reads + prepare + preview**. Every apply path is

package/cordis.patch.yml

@@ -3,7 +3,7 @@
 # Mounts the packaged `ast-mcp-server` stdio command through the official
 # `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
 # from PATH, so the entrypoint is resolved relative to the profile directory
-# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.14.0.tgz`
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.14.2.tgz`
 # installs a locally packed package as a dependency.
 #
 # First-slice surface: reads + prepare + preview. Every apply path is denied

package/dist/compiler-worker-entry.js

@@ -21,7 +21,7 @@ export function installPrivateControl(runtime, input) {
     else
         process.exit(1); }; setTimeout(force, (handle.shutdownGraceMs ?? 10_000) + 2_000).unref(); };
     const shutdown = (handle, trigger) => { if (trigger === "parent_exit")
-        arm(handle); void handle.shutdown(trigger).finally(() => process.disconnect()); };
+        arm(handle); void handle.shutdown(trigger).finally(() => process.disconnect?.()); };
     process.on("message", (message) => { const decoded = decodeCompilerWorkerEnvelope(JSON.stringify(message)); if (!decoded.ok)
         return; if (decoded.value.type === "handshake") {
         generation = decoded.value.generation;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -63,7 +63,7 @@
     "fast-uri": "3.1.9",
     "hono": "4.13.13",
     "nanoid": "3.3.18",
-    "qs": "6.16.0"
+    "qs": "6.16.1"
   },
   "scripts": {
     "build": "tsc",
@@ -101,22 +101,23 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@toon-format/toon": "4.1.0",
+    "@toon-format/toon": "4.4.0",
     "diff": "^9.0.0",
     "jsonc-parser": "^3.3.1",
-    "ts-morph": "24.0.0",
+    "ts-morph": "28.0.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^22.5.0",
+    "@types/node": "^26.6.5",
     "eslint": "^10.8.0",
-    "gpt-tokenizer": "3.4.0",
+    "gpt-tokenizer": "4.1.0",
     "prettier": "^3.9.6",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.65.0",
-    "vitest": "^4.1.12",
+    "vite": "^8.3.4",
+    "vitest": "^5.0.5",
     "yaml": "^2.9.0"
   },
-  "gitHead": "f6e64751398f69eb3f0f1abc808f4221f7d2bc52"
+  "gitHead": "425a967002178dde685cae1dcf0ec5fad533ff54"
 }