bc-telemetry-buddy-mcp 3.7.0 → 3.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +2 -2
- package/dist/cli.js +217 -209
- package/dist/server.js +181 -173
- package/package.json +4 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [3.7.1] - 2026-10-23
|
|
11
|
+
|
|
12
|
+
_Highest blast-radius rating across all plans landed in this release: `low-risk`._
|
|
13
|
+
|
|
14
|
+
### Security
|
|
15
|
+
- **Node.js runtime security floor** ([#134](https://github.com/waldo1001/waldo.BCTelemetryBuddy/issues/134)): the server now writes a one-line warning to stderr at startup when it runs on a Node.js version without the [October 2026 Node.js security fixes](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) (CVE-2026-111497 Brotli RCE, TLS hostname bypasses). That covers Node.js < 22.23.4, < 24.22.1 or < 26.12.1, and end-of-life lines (≤ 20, 23, 25). It only warns: startup is never blocked, and stdout (the stdio protocol) is never touched. Spec: [docs/specs/134-node-runtime-security-floor.md](../../docs/specs/134-node-runtime-security-floor.md).
|
|
16
|
+
- `engines.node` is now `^22.23.4 || ^24.22.1 || >=26.12.1`. npm shows an `EBADENGINE` warning when you install on an older Node.js.
|
|
17
|
+
- **Telemetry**: `TB-MCP-007` (`RUNTIME_UNPATCHED`), fired once per start on an unpatched runtime with `nodeVersion` and `reason` (`eol` | `below-patched`).
|
|
18
|
+
|
|
19
|
+
### Changed
|
|
20
|
+
- CI and release workflows dropped Node.js 20 (end-of-life). Tests now run on 22.x and 24.x.
|
|
21
|
+
|
|
10
22
|
## [3.7.0] - 2026-07-18
|
|
11
23
|
|
|
12
24
|
_Highest blast-radius rating across all plans landed in this release: `low-risk`._
|
package/README.md
CHANGED
|
@@ -42,7 +42,7 @@ bctb-mcp --version
|
|
|
42
42
|
|
|
43
43
|
### Prerequisites
|
|
44
44
|
|
|
45
|
-
- **Node.js
|
|
45
|
+
- **Node.js 22.23.4+, 24.22.1+ or 26.12.1+** installed (the server warns at startup on an older, unpatched Node.js)
|
|
46
46
|
- **Application Insights** set up for Business Central telemetry
|
|
47
47
|
- **Azure authentication** configured (see Authentication section below)
|
|
48
48
|
|
|
@@ -638,7 +638,7 @@ bctb-mcp start
|
|
|
638
638
|
## Development
|
|
639
639
|
|
|
640
640
|
### Prerequisites
|
|
641
|
-
- Node.js
|
|
641
|
+
- Node.js 22.23.4+, 24.22.1+ or 26.12.1+
|
|
642
642
|
- npm 9+
|
|
643
643
|
- Azure CLI (for `azure_cli` auth flow)
|
|
644
644
|
|