drupal-mcp-connector 1.8.0 → 1.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/README.md +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [1.8.1] - 2026-07-23
|
|
11
|
+
|
|
12
|
+
### Security
|
|
13
|
+
- Resolved npm audit high/low advisories via a compatible lockfile bump:
|
|
14
|
+
`brace-expansion` DoS (GHSA-3jxr-9vmj-r5cp), `fast-uri` host confusion
|
|
15
|
+
(GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6), and `body-parser` DoS
|
|
16
|
+
(GHSA-v422-hmwv-36x6). Two residual moderate `@hono/node-server` advisories
|
|
17
|
+
(Windows-only path traversal, GHSA-frvp-7c67-39w9) are tracked in #128, blocked
|
|
18
|
+
on an `@modelcontextprotocol/sdk` release accepting hono 2.x.
|
|
19
|
+
|
|
10
20
|
## [1.8.0] - 2026-07-23
|
|
11
21
|
|
|
12
22
|
### Added
|
package/README.md
CHANGED
|
@@ -134,7 +134,7 @@ Defense-in-depth with four one-line presets, enforced connector-side and complem
|
|
|
134
134
|
| Preset | What it does |
|
|
135
135
|
|--------|-------------|
|
|
136
136
|
| `development` | Everything allowed — local development only |
|
|
137
|
-
| `content-editor` | Create/edit nodes, media, terms; no deletes; no user access |
|
|
137
|
+
| `content-editor` | Create/edit nodes, media, terms; no deletes; no publishing (`allowPublish` off); no user access |
|
|
138
138
|
| `auditor` | Read-only, all entity types, PII fields redacted |
|
|
139
139
|
| `production-strict` | Read-only, no user entities, broad PII redaction |
|
|
140
140
|
|
package/package.json
CHANGED