n8n-mcp-community 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -6,6 +6,27 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.2] - Frozen release candidate
+
+Version 0.3.2 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Security
+
+- The runtime now uses `@modelcontextprotocol/sdk` 1.32.1, which removes the
+  vulnerable `1.30.0` release identified by GHSA-6qxp-vccf-f47h.
+- The resolved Express dependency is now 5.3.0 and uses `proxy-addr` 2.0.8,
+  clearing GHSA-jqcg-44mw-7w3h from both production and complete npm audits.
+- Runtime SBOM generation now derives its inventory from every production
+  lockfile path and rejects omissions, including packages that npm also sees
+  through a development path.
+
+### Changed
+
+- `typescript-eslint` is updated to 8.71.2. This maintenance release does not
+  change the public 44-tool, 5-resource, and 4-prompt MCP contract.
+
 ## [0.3.1] - Frozen release candidate
 
 Version 0.3.1 is a frozen release candidate. Availability is established only
@@ -367,6 +388,7 @@ Registry readbacks; this immutable entry is not rewritten after publication.
   publishable history; authenticated public release receipts remain supported.
 
 [Unreleased]: #unreleased
+[0.3.2]: #032---frozen-release-candidate
 [0.3.1]: #031---frozen-release-candidate
 [0.3.0]: #030---frozen-release-candidate
 [0.2.1]: #021---frozen-release-candidate

package/README.md

@@ -104,7 +104,7 @@ how to check the download.
 The current source candidate has been verified with:
 
 - exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
-- **319 passing tests** locally on Node.js 24.21.0; CI and release gates require
+- **320 passing tests** locally on Node.js 24.21.0; CI and release gates require
   the pinned Node.js 22.23.1 and 24.18.0 matrix;
 - zero findings from Gitleaks, Semgrep, Trivy, and both project-root
   production/full `npm audit` runs; all three source scanners are reproduced in
@@ -112,7 +112,7 @@ The current source candidate has been verified with:
 - a separate no-override consumer install that resolves the patched
   `@hono/node-server` 2.x line, requires a zero-finding production audit, and
   proves the stdio runtime and exact 44/5/4 inventory;
-- a reproducible dependency-license gate covering 186 installed package paths;
+- a reproducible dependency-license gate covering 187 installed package paths;
 - bounded same-origin HTTP contracts and zero-request policy-denial tests;
 - all 44 compiled tool lifecycles on disposable n8n Community 2.30.5 and 2.30.7
   instances with egress isolation, revoked keys, cleanup, and zero residue; and

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "0.3.1";
+export const PACKAGE_VERSION = "0.3.2";

package/docs/compatibility.md

@@ -20,6 +20,12 @@ The package declares Node.js `>=22.0.0`. That engine range is an acceptance
 floor, not evidence that every later major has completed the release matrix.
 The supported release lines for v0.3.x are Node.js 22 and 24.
 
+## Upgrading to 0.3.2
+
+Install `n8n-mcp-community@latest` again, then restart the MCP client. This
+maintenance release updates the MCP SDK and its resolved HTTP dependencies; it
+does not change the connection values, modes, or 44/5/4 MCP inventory.
+
 ## Upgrading to 0.3.0
 
 Install `n8n-mcp-community@latest` again, then restart the MCP client. The
@@ -48,7 +54,7 @@ names. MCP clients receive these constraints when they reconnect.
 The connection values are unchanged. Global npm users keep the same client
 entry. Users who followed the 0.1.x npx guide must replace the pinned
 `n8n-mcp-community@0.1.4` argument with `n8n-mcp-community@latest` or
-`n8n-mcp-community@0.3.1`. After updating, restart the MCP client and confirm the
+`n8n-mcp-community@0.3.2`. After updating, restart the MCP client and confirm the
 version and 44/5/4 inventory.
 
 Since 0.2.0, the 14 unsafe tools no longer publish or require a `confirmation` field;

package/docs/installation.md

@@ -92,7 +92,7 @@ unsafe tools.
 
 Global npm users do not edit the client entry. If you followed the 0.1.x npx
 guide, your client is pinned to `n8n-mcp-community@0.1.4`: replace that argument
-with `n8n-mcp-community@latest` or `n8n-mcp-community@0.3.1`. Restart the client,
+with `n8n-mcp-community@latest` or `n8n-mcp-community@0.3.2`. Restart the client,
 run the npx version check below, and confirm the 44/5/4 inventory.
 
 If custom code sends raw tool-call JSON, remove the former `confirmation` field

package/docs/provenance.md

@@ -53,9 +53,9 @@ fails on:
 - missing license metadata;
 - a package that declares a license or notice file but omits it.
 
-The current source candidate covers 186 installed package paths representing
-185 unique components: 93 runtime paths and 93 development paths. The effective
-licenses are 151 MIT, 11 ISC, 13 Apache-2.0, 7 BSD-2-Clause, 3 BSD-3-Clause,
+The current source candidate covers 187 installed package paths representing
+186 unique components: 94 runtime paths and 93 development paths. The effective
+licenses are 152 MIT, 11 ISC, 13 Apache-2.0, 7 BSD-2-Clause, 3 BSD-3-Clause,
 and 1 BlueOak-1.0.0, with no missing integrity, license, or documented notice.
 Four exact-pinned development-only packages use the reviewed missing-file
 exception described in [third-party notices](../THIRD_PARTY_NOTICES.md). No
@@ -82,13 +82,18 @@ Generate the release runtime CycloneDX SBOM from the committed lockfile with:
 npm run sbom > sbom.cdx.json
 ```
 
-This runtime-only SBOM contains 78 unique production components for the shared
-npm/MCPB runtime graph. Maintainers may separately generate the complete
-185-component graph with `npm run sbom:full`; it is audit evidence,
-not the release artifact SBOM. Every release candidate must carry a runtime
-SBOM for the npm package and MCPB, plus SHA-256 checksums and signatures tied to
-the exact Git revision; availability is established only by the corresponding
-published-release readbacks.
+The runtime-only SBOM contains all 93 unique production components across the
+94 production lockfile paths shared by the npm and MCPB runtime. The generator
+starts from npm's complete CycloneDX graph, derives the runtime set from the
+committed lockfile, and rejects missing, extra, development-only, or invalid
+dependency entries. This prevents npm's `--omit=dev` classification from
+dropping a runtime component that is also reachable through development tools.
+Maintainers may separately generate the complete 186-component graph with
+`npm run sbom:full`; it is audit evidence, not the release artifact SBOM.
+
+Every release candidate must carry a runtime SBOM for the npm package and MCPB, plus
+SHA-256 checksums and signatures tied to the exact Git revision; availability
+is established only by the corresponding published-release readbacks.
 The package and MCPB must be reconstructed from a clean checkout and match the
 documented inventory.
 

package/docs/security-model.md

@@ -1,6 +1,6 @@
 # Security model
 
-This document describes the controls and residual risks of the v0.3.1 source
+This document describes the controls and residual risks of the v0.3.2 source
 candidate. It is a threat model, not a claim that the software or the connected
 n8n instance is invulnerable.
 
@@ -157,15 +157,16 @@ native confirmations based on the published MCP annotations.
 
 ### Downstream dependency resolution
 
-MCP SDK 1.30.0 permits the patched `@hono/node-server` 2.x line directly, so
-this project no longer needs a package-root override that downstream consumers
-would not inherit. The verification gate packs the candidate, installs it in a
-disposable consumer without overrides, rejects `@hono/node-server` versions
-below 2.0.5 or outside major version 2, requires a zero-finding production
-audit, and proves the exact MCP inventory still starts. Candidate evidence does
-not establish publication: the released version must pass the same clean
-consumer audit after npm provenance and the other external release readbacks
-agree.
+The pinned MCP SDK 1.32.1 permits the patched `@hono/node-server` 2.x line
+directly, so this project no longer needs a package-root override that
+downstream consumers would not inherit. Its Express range also resolves
+Express 5.3.0 with `proxy-addr` 2.0.8 in this candidate. The verification gate
+packs the candidate, installs it in a disposable consumer without overrides,
+rejects `@hono/node-server` versions below 2.0.5 or outside major version 2,
+requires a zero-finding production audit, and proves the exact MCP inventory
+still starts. Candidate evidence does not establish publication: the released
+version must pass the same clean consumer audit after npm provenance and the
+other external release readbacks agree.
 
 The SDK dependency range also permits the legacy 1.x line. A separate host
 project that co-installs another dependency constraining `@hono/node-server` to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-mcp-community",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A security-focused MCP server for self-hosted n8n Community Edition.",
   "private": false,
   "releaseState": "candidate",
@@ -87,6 +87,7 @@
     "check:registry": "node scripts/verify-registry-schema.mjs",
     "check:readme-count": "node scripts/verify-readme-test-count.mjs",
     "check:release": "node scripts/verify-release-policy.mjs",
+    "check:sbom": "node scripts/generate-runtime-sbom.mjs --check",
     "docs:check": "npm run build && node scripts/verify-documentation.mjs",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
@@ -97,7 +98,7 @@
     "prepublishOnly": "npm run verify",
     "demo:check": "node scripts/render-demo-gif.mjs --check",
     "demo:render": "node scripts/render-demo-gif.mjs",
-    "sbom": "npm sbom --package-lock-only --omit=dev --sbom-format cyclonedx --sbom-type application",
+    "sbom": "node scripts/generate-runtime-sbom.mjs",
     "sbom:full": "npm sbom --package-lock-only --sbom-format cyclonedx --sbom-type application",
     "test:contract": "npm run build && npm run test:compile && node --test --test-concurrency=1 .test-dist/test/mcp-contract.test.js .test-dist/test/n8n-client.test.js .test-dist/test/tool-contract.test.js",
     "test:coverage": "npm run build && npm run test:compile && node --test --test-concurrency=1 --experimental-test-coverage --test-coverage-include='.test-dist/src/**/*.js' --test-coverage-exclude='.test-dist/src/index.js' --test-coverage-lines=90 --test-coverage-functions=90 --test-coverage-branches=85 .test-dist/test/**/*.test.js",
@@ -105,13 +106,13 @@
     "test:examples": "npm run build && node scripts/verify-examples.mjs",
     "test": "npm run build && npm run test:compile && node --test --test-concurrency=1 .test-dist/test/**/*.test.js",
     "typecheck": "tsc --noEmit --pretty false && tsc -p tsconfig.scripts.json --pretty false",
-    "check": "npm run format:check && npm run licenses:check && npm run lint && npm run typecheck && npm test && npm run check:readme-count && npm run check:metadata && npm run check:release && npm run check:docs && npm run check:language && npm run test:examples && npm run check:inventory && npm run check:public-boundary && npm run check:artifact-review",
-    "check:contributor": "npm run format:check && npm run licenses:check && npm run lint && npm run typecheck && npm test && npm run check:readme-count && npm run check:metadata && npm run check:release && npm run check:docs && npm run check:language && npm run test:examples && npm run check:inventory && npm run check:public-boundary",
+    "check": "npm run format:check && npm run licenses:check && npm run check:sbom && npm run lint && npm run typecheck && npm test && npm run check:readme-count && npm run check:metadata && npm run check:release && npm run check:docs && npm run check:language && npm run test:examples && npm run check:inventory && npm run check:public-boundary && npm run check:artifact-review",
+    "check:contributor": "npm run format:check && npm run licenses:check && npm run check:sbom && npm run lint && npm run typecheck && npm test && npm run check:readme-count && npm run check:metadata && npm run check:release && npm run check:docs && npm run check:language && npm run test:examples && npm run check:inventory && npm run check:public-boundary",
     "verify": "npm run check && npm run test:coverage && npm run check:distribution && npm run check:consumer && npm run check:registry",
     "verify:contributor": "npm run check:contributor && npm run test:coverage && npm run check:distribution:contributor && npm run check:consumer && npm run check:registry"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "zod": "3.25.76"
   },
   "devDependencies": {
@@ -124,7 +125,7 @@
     "globals": "17.13.0",
     "prettier": "3.9.9",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.71.0",
+    "typescript-eslint": "8.71.2",
     "yaml": "2.9.1"
   }
 }

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/drzamarian/n8n-mcp-community",
     "source": "github"
   },
-  "version": "0.3.1",
+  "version": "0.3.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "n8n-mcp-community",
-      "version": "0.3.1",
+      "version": "0.3.2",
       "transport": {
         "type": "stdio"
       },