bc-telemetry-buddy-mcp 3.7.0 → 3.7.2

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.7.2] - 2026-10-23
+
+_Highest blast-radius rating across all plans landed in this release: `low-risk`._
+
+### Security
+- Runtime dependency security fixes ([#135](https://github.com/waldo1001/waldo.BCTelemetryBuddy/issues/135)), all within the current major versions: `proxy-addr` 2.0.8 (critical, via `express` ^4.22.3), `axios` ^1.20.0, `follow-redirects` 1.16.1, `@modelcontextprotocol/sdk` ^1.32.1, `fast-uri` 3.1.9, `ip-address` 10.7.4, `@grpc/grpc-js` 1.14.6, and the OpenTelemetry / Azure Monitor stack (`applicationinsights` 3.17.0). `npm audit --omit=dev` now reports no high or critical findings.
+
+### Changed
+- Published through **npm Trusted Publishing (OIDC)** with provenance; the long-lived `NPM_TOKEN` is gone ([#137](https://github.com/waldo1001/waldo.BCTelemetryBuddy/issues/137)). The release workflows run all `actions/*` on their Node 24 majors, and the npm check after publishing retries for up to 5 minutes instead of reporting a false 404.
+
+## [3.7.1] - 2026-10-23
+
+_Highest blast-radius rating across all plans landed in this release: `low-risk`._
+
+### Security
+- **Node.js runtime security floor** ([#134](https://github.com/waldo1001/waldo.BCTelemetryBuddy/issues/134)): the server now writes a one-line warning to stderr at startup when it runs on a Node.js version without the [October 2026 Node.js security fixes](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) (CVE-2026-111497 Brotli RCE, TLS hostname bypasses). That covers Node.js < 22.23.4, < 24.22.1 or < 26.12.1, and end-of-life lines (≤ 20, 23, 25). It only warns: startup is never blocked, and stdout (the stdio protocol) is never touched. Spec: [docs/specs/134-node-runtime-security-floor.md](../../docs/specs/134-node-runtime-security-floor.md).
+- `engines.node` is now `^22.23.4 || ^24.22.1 || >=26.12.1`. npm shows an `EBADENGINE` warning when you install on an older Node.js.
+- **Telemetry**: `TB-MCP-007` (`RUNTIME_UNPATCHED`), fired once per start on an unpatched runtime with `nodeVersion` and `reason` (`eol` | `below-patched`).
+
+### Changed
+- CI and release workflows dropped Node.js 20 (end-of-life). Tests now run on 22.x and 24.x.
+
 ## [3.7.0] - 2026-07-18
 
 _Highest blast-radius rating across all plans landed in this release: `low-risk`._

package/README.md

@@ -42,7 +42,7 @@ bctb-mcp --version
 
 ### Prerequisites
 
-- **Node.js 18+** installed
+- **Node.js 22.23.4+, 24.22.1+ or 26.12.1+** installed (the server warns at startup on an older, unpatched Node.js)
 - **Application Insights** set up for Business Central telemetry
 - **Azure authentication** configured (see Authentication section below)
 
@@ -638,7 +638,7 @@ bctb-mcp start
 ## Development
 
 ### Prerequisites
-- Node.js 18+
+- Node.js 22.23.4+, 24.22.1+ or 26.12.1+
 - npm 9+
 - Azure CLI (for `azure_cli` auth flow)