drupal-mcp-connector 3.0.0 → 3.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +7 -0
- package/package.json +1 -1
- package/src/lib/http-auth.js +2 -2
- package/src/lib/verify.js +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [3.0.1] - 2026-10-01
|
|
11
|
+
|
|
12
|
+
### Fixed
|
|
13
|
+
- **Shared-bearer removal target is v4.0.0.** 3.0.0 shipped the node-tool
|
|
14
|
+
break and left loopback `shared_bearer` in place. The startup warning and
|
|
15
|
+
the verify residual now name v4.0.0 (#231).
|
|
16
|
+
|
|
10
17
|
## [3.0.0] - 2026-10-01
|
|
11
18
|
|
|
12
19
|
### Fixed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "drupal-mcp-connector",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.1",
|
|
4
4
|
"description": "Multi-site MCP server for Drupal over JSON:API and GraphQL, with governed writes and an SSH Drush bridge. init writes a stdio or Tailscale client config from a transport preset. doctor checks reachability, auth, and readiness, and reports version skew. A timestamp gap on a published revision no longer blocks the next draft.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|
package/src/lib/http-auth.js
CHANGED
|
@@ -556,7 +556,7 @@ export function resolveInboundAuthMode({
|
|
|
556
556
|
/**
|
|
557
557
|
* Startup deprecation warning for inbound auth mode `shared_bearer` (#231).
|
|
558
558
|
*
|
|
559
|
-
* Removal is the next major (
|
|
559
|
+
* Removal is the next major (v4.0.0). Resource-server and unauthenticated
|
|
560
560
|
* modes are silent. The warning names the issue and the removal version so
|
|
561
561
|
* a loopback install cannot miss the kill criterion.
|
|
562
562
|
*
|
|
@@ -567,7 +567,7 @@ export function inboundAuthDeprecationWarning(mode) {
|
|
|
567
567
|
if (mode !== "shared_bearer") return null;
|
|
568
568
|
return (
|
|
569
569
|
"[drupal-mcp-connector] WARNING: inbound auth mode shared_bearer is deprecated " +
|
|
570
|
-
"and will be removed in
|
|
570
|
+
"and will be removed in v4.0.0 (#231). Configure an OAuth resource server " +
|
|
571
571
|
"(auth.issuer + auth.audience) or run unauthenticated loopback. " +
|
|
572
572
|
"MCP_ALLOW_UNAUTHENTICATED remains the explicit trusted-proxy opt-in."
|
|
573
573
|
);
|
package/src/lib/verify.js
CHANGED
|
@@ -82,7 +82,7 @@ export const RESIDUALS = [
|
|
|
82
82
|
status: "managed",
|
|
83
83
|
detail:
|
|
84
84
|
"Loopback MCP_AUTH_TOKEN (inbound mode shared_bearer) still ships. It is " +
|
|
85
|
-
"deprecated as of this release and will be removed in
|
|
85
|
+
"deprecated as of this release and will be removed in v4.0.0 (#231). " +
|
|
86
86
|
"Network-facing product paths already refuse it. MCP_ALLOW_UNAUTHENTICATED " +
|
|
87
87
|
"is a separate named residual: an explicit trusted-proxy opt-in, not a " +
|
|
88
88
|
"shared credential, and is not retired by #231.",
|