premiere-pro-mcp 1.9.1 → 1.9.3

package/CHANGELOG.md

@@ -6,6 +6,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.9.3] - 2026-08-12
+
+### Added
+
+- Added the Premiere Pro MCP cinematic intro video to the landing assets.
+- Added the dated security best-practices audit report for repository reference.
+
+### Changed
+
+- Simplified the README release overview to show only the latest release and link
+  to the complete GitHub release notes.
+
+### Security
+
+- Updated the landing build's transitive `nanoid` dependency to a patched version.
+
+## [1.9.2] - 2026-08-04
+
+### Fixed
+
+- Changed the CEP Premiere host declaration to a minimum-only supported version
+  so Adobe Developer Distribution does not reject the signed ZXP for claiming
+  an unsupported future maximum.
+- Updated transitive URL, HTTP middleware, and IP-address parsing dependencies
+  to patched versions after newly disclosed security advisories.
+
+### Added
+
+- Added a public privacy policy covering local media processing, optional MCP
+  operational telemetry, website analytics, retention, and user choices.
+
 ## [1.9.1] - 2026-08-02
 
 ### Security

package/README.md

@@ -29,49 +29,18 @@ An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that l
 
 The AI handles the entire workflow through 280 core tools spanning the supported ExtendScript, QE DOM, local media analysis, safe edit-planning, and connection-verification surfaces. A compatible, authenticated UXP panel adds 19 documented, capability-gated workflows without replacing the production CEP bridge.
 
-### What's new in 1.9.1
-
-- **Production browser hardening:** every HTTP response now includes CSP, HSTS,
-  MIME sniffing protection, frame denial, bounded permissions, and explicit
-  referrer and cross-origin policies.
-
-### Previous release: 1.9.0
-
-- **Assistant-first setup:** Claude Desktop users start with a validated MCPB
-  bundle, while npm and manual JSON configuration stay under Advanced setup.
-- **Safe connection help:** `verify_premiere_connection`, `--doctor`, the CEP
-  Connection Center, and sanitized support bundles explain exactly what is
-  installed, configured, connected, and live-verified.
-- **Distribution foundations:** MCPB v0.4, deterministic direct/Marketplace CCX
-  packaging, and native Windows/macOS CEP installer pipelines make the supported
-  routes easier to package without overstating signing or Marketplace approval.
-- **Canonical tool surface:** 280 registered tools, 278 in the default profile,
-  and 297 while the 19 capability-gated UXP tools are connected.
-
-### Previous release: 1.8.0
-
-- **Native transcript planning:** compatible UXP hosts can export and search the
-  transcript Premiere generated for a clip, then preview a revision-locked set of
-  source-time deletion ranges.
-- **No false edit promise:** previews return a deterministic confirmation token and
-  never modify a clip or timeline. Automated application remains withheld until the
-  documented source-to-sequence reconstruction path passes real-host validation.
-- **19 connected UXP tools:** the capability-gated UXP surface grows from 16 to 19
-  without changing the 279 core-tool surface.
-
-### Earlier release: 1.7.0
-
-- **Six documented workflows:** compatible 26.3+ hosts can expose UXP track renaming, subclip creation, stable marker IDs, Source Monitor seeking, transcript presence checks, and AAF export.
-- **Capability first:** a tool is discoverable only with the authenticated local panel; the panel's live `capabilities.get` response—not package metadata—decides whether the current host supports it.
-- **Evidence boundary:** automated tests validate schemas, routing, capability declarations, transactions, and result envelopes. They do not verify a specific Premiere installation. See [Adobe UXP 26.3 coverage](docs/adobe-uxp-26.3-coverage.md) for the exact host gate and the stable-versus-beta policy.
-- **Adobe-aligned validation:** the official Premiere 26.3 declarations and ESLint rules now enforce supported signatures and lock/transaction boundaries in CI.
-
-### Added in 1.2.0
-
-- **Safe edit plans:** preview compound insert/remove operations, bind approval to a SHA-256 plan token, then apply the validated plan in one bridge command.
-- **Capability profiles:** unsafe scripting is disabled by default and requires explicit `unsafe-script` authority.
-- **Modern MCP responses:** tools expose safety annotations and structured results; four workflow prompts and a machine-readable workflow resource guide common edits.
-- **UXP bridge preview:** a packaged Premiere 25.6+ panel adds capability discovery, event-driven state notifications with a deduplicated polling fallback, correlated operation lifecycle events, reconnecting WebSocket transport, and supported frame export with file verification. Cancellation is cooperative before non-cancellable host calls; no atomic rollback is claimed. Live host verification is still required.
+### Latest release: 1.9.3
+
+- **Focused release overview:** the README now shows only the current release instead of carrying
+  an expanding history of older release summaries.
+- **New media asset:** the landing package includes the Premiere Pro MCP cinematic intro video.
+- **Security reference:** the repository includes the dated security audit report and its explicit
+  verification boundaries.
+- **Patched dependency:** the landing build now resolves the transitive `nanoid` dependency to a
+  version that addresses the latest high-severity advisory.
+
+See the [v1.9.3 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.9.3)
+for complete details. Live installation in Premiere Pro still requires host verification.
 
 ---
 
@@ -79,9 +48,9 @@ The AI handles the entire workflow through 280 core tools spanning the supported
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.1/premiere-pro-mcp-1.9.1.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.3/premiere-pro-mcp-1.9.3.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.1/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.3/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP Bridge**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -305,11 +274,11 @@ From a clone of this repository:
 ```bash
 codex plugin marketplace add .
 codex plugin add premiere-pro@premiere-pro-mcp
-npx -y premiere-pro-mcp@1.9.1 --install-cep
+npx -y premiere-pro-mcp@1.9.3 --install-cep
 ```
 
 Restart Premiere Pro and start a new Codex session after installation. The plugin
-launches `premiere-pro-mcp@1.9.1` through `npx`; the separate CEP installation is
+launches `premiere-pro-mcp@1.9.3` through `npx`; the separate CEP installation is
 required because the MCP server communicates with the running Premiere host through
 the local bridge.
 
@@ -329,7 +298,7 @@ For Claude Code, add this repository as a marketplace and install the plugin:
 Then install the Premiere bridge and start a new Claude Code session:
 
 ```bash
-npx -y premiere-pro-mcp@1.9.1 --install-cep
+npx -y premiere-pro-mcp@1.9.3 --install-cep
 ```
 
 The Claude Code package lives in

package/cep-plugin/CSXS/manifest.xml

@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.9.1" ExtensionBundleName="MCP Bridge">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.9.3" ExtensionBundleName="MCP Bridge">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.9.1"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.9.1"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.9.3"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.9.3"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>
-      <Host Name="PPRO" Version="[14.0,99.9]"/>
+      <Host Name="PPRO" Version="14.0"/>
     </HostList>
     <LocaleList>
       <Locale Code="All"/>

package/cep-plugin/index.html

@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">Connector updates</span>
-        <strong id="updateTitle">Version 1.9.1</strong>
+        <strong id="updateTitle">Version 1.9.3</strong>
         <span id="updateDetail">Checking for updates…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" disabled>

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.9.1";
+  var CURRENT_VERSION = "1.9.3";
   var LATEST_RELEASE_API =
     "https://api.github.com/repos/leancoderkavy/premiere-pro-mcp/releases/latest";
   var RELEASES_URL =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premiere-pro-mcp",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "Adobe Premiere Pro MCP server with 280 core AI video editing tools and a capability-aware UXP bridge for supported Premiere workflows.",
   "main": "dist/index.js",
   "types": "./dist/index.d.ts",
@@ -97,6 +97,9 @@
   },
   "overrides": {
     "@hono/node-server": "^2.0.5",
-    "body-parser": "^2.3.0"
+    "body-parser": "^2.3.0",
+    "fast-uri": "^3.1.5",
+    "hono": "^4.12.34",
+    "ip-address": "^10.4.0"
   }
 }

package/uxp-plugin/manifest.json

@@ -2,7 +2,7 @@
   "manifestVersion": 5,
   "id": "com.ppmcp.premiere.uxp",
   "name": "Premiere Pro MCP Bridge",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "main": "index.html",
   "host": { "app": "premierepro", "minVersion": "25.6.0" },
   "entrypoints": [