mcp-rubber-duck 1.4.0 → 1.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/security.yml +2 -0
- package/.trivyignore +8 -0
- package/CHANGELOG.md +7 -0
- package/Dockerfile +1 -1
- package/audit-ci.json +1 -2
- package/package.json +2 -2
|
@@ -28,6 +28,7 @@ jobs:
|
|
|
28
28
|
scan-ref: '.'
|
|
29
29
|
format: 'sarif'
|
|
30
30
|
output: 'trivy-results.sarif'
|
|
31
|
+
trivyignores: '.trivyignore'
|
|
31
32
|
|
|
32
33
|
- name: 📤 Upload Trivy scan results to GitHub Security
|
|
33
34
|
uses: github/codeql-action/upload-sarif@v3
|
|
@@ -48,6 +49,7 @@ jobs:
|
|
|
48
49
|
image-ref: 'security-scan-image'
|
|
49
50
|
format: 'sarif'
|
|
50
51
|
output: 'trivy-docker-results.sarif'
|
|
52
|
+
trivyignores: '.trivyignore'
|
|
51
53
|
|
|
52
54
|
- name: 📤 Upload Docker scan results
|
|
53
55
|
uses: github/codeql-action/upload-sarif@v3
|
package/.trivyignore
ADDED
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
# BusyBox vulnerabilities in node:20-alpine base image
|
|
2
|
+
# These require local access and are accepted risk for this container
|
|
3
|
+
CVE-2025-30680
|
|
4
|
+
CVE-2024-42237
|
|
5
|
+
|
|
6
|
+
# brace-expansion ReDoS - bundled in npm, low severity (CVSS 3.1)
|
|
7
|
+
# Cannot be fixed without upstream semantic-release update
|
|
8
|
+
CVE-2025-5889
|
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
|
+
## [1.4.1](https://github.com/nesquikm/mcp-rubber-duck/compare/v1.4.0...v1.4.1) (2025-12-08)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Bug Fixes
|
|
5
|
+
|
|
6
|
+
* **security:** update MCP SDK and address code scanning alerts ([08b3a40](https://github.com/nesquikm/mcp-rubber-duck/commit/08b3a40f9aaa053138003258812b0d4c8bbddfc3))
|
|
7
|
+
|
|
1
8
|
# [1.4.0](https://github.com/nesquikm/mcp-rubber-duck/compare/v1.3.0...v1.4.0) (2025-11-30)
|
|
2
9
|
|
|
3
10
|
|
package/Dockerfile
CHANGED
package/audit-ci.json
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-rubber-duck",
|
|
3
|
-
"version": "1.4.
|
|
3
|
+
"version": "1.4.1",
|
|
4
4
|
"description": "An MCP server that bridges to multiple OpenAI-compatible LLMs - your AI rubber duck debugging panel",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"type": "module",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"url": "https://github.com/nesquikm/mcp-rubber-duck/issues"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@modelcontextprotocol/sdk": "^1.
|
|
41
|
+
"@modelcontextprotocol/sdk": "^1.24.0",
|
|
42
42
|
"ajv": "^8.17.1",
|
|
43
43
|
"dotenv": "^16.4.0",
|
|
44
44
|
"node-cache": "^5.1.2",
|