redditapis-mcp 0.3.1 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/package.json +1 -1
- package/server.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.3.2
|
|
4
|
+
- **Security: 10 Dependabot alerts closed (3 high, 6 moderate, 1 low)**, all in
|
|
5
|
+
transitive dependencies pulled in by `@modelcontextprotocol/sdk` (never a
|
|
6
|
+
direct dependency of this package): `hono` (SSR output cross-user
|
|
7
|
+
disclosure, ReDoS in CORS/language middleware, header handling in the proxy
|
|
8
|
+
helper), `fast-uri` (host confusion via a backslash authority delimiter),
|
|
9
|
+
`ip-address` (three separate SSRF/trust-boundary bypasses via octal,
|
|
10
|
+
IPv4-mapped, and CIDR-suffix address confusion), and `@hono/node-server`
|
|
11
|
+
(path traversal on Windows). Fixed by a clean reinstall against the
|
|
12
|
+
existing `@modelcontextprotocol/sdk: ^1.0.0` range, which already permitted
|
|
13
|
+
the patched versions; no version constraint changed, only the resolved
|
|
14
|
+
tree (SDK 1.29.0 to 1.30.0, hono to 4.13.2, fast-uri to 3.1.5, ip-address
|
|
15
|
+
to 10.5.0, @hono/node-server to 2.1.1). This server only imports the SDK's
|
|
16
|
+
stdio transport (confirmed: `src/index.js` never imports `hono` or the
|
|
17
|
+
SDK's HTTP transport), so `hono` and `@hono/node-server` never load at
|
|
18
|
+
runtime here; `fast-uri` and `ip-address` sit deeper in the SDK's own
|
|
19
|
+
dependency tree and were not individually traced. Fixed regardless, since
|
|
20
|
+
Dependabot flags them independent of reachability and a clean scan is
|
|
21
|
+
the point.
|
|
22
|
+
|
|
3
23
|
## 0.3.1
|
|
4
24
|
- **Fix: the server no longer exits at startup when `REDDITAPIS_KEY` is missing.**
|
|
5
25
|
A registry connectivity scanner (Smithery, Glama, the official MCP registry,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "redditapis-mcp",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.2",
|
|
4
4
|
"mcpName": "io.github.redditapis/redditapis-mcp",
|
|
5
5
|
"description": "Official MCP server for redditapis.com, the Reddit API (subreddit listings, post + comment + community + user + media search, comment trees, top posts, user profiles) plus monitor/webhook management (create/list/update/remove a monitor, register/test/delete a webhook, read delivery history) as native tools for Claude, Cursor, and any MCP client.",
|
|
6
6
|
"repository": {
|
package/server.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"name": "io.github.redditapis/redditapis-mcp",
|
|
4
4
|
"description": "Reddit API as MCP tools: search, subreddits, posts, comments, users, monitors, and webhooks.",
|
|
5
5
|
"title": "RedditAPIs",
|
|
6
|
-
"version": "0.3.
|
|
6
|
+
"version": "0.3.2",
|
|
7
7
|
"websiteUrl": "https://www.redditapis.com",
|
|
8
8
|
"repository": {
|
|
9
9
|
"url": "https://github.com/redditapis/redditapis-mcp",
|
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
{
|
|
14
14
|
"registryType": "npm",
|
|
15
15
|
"identifier": "redditapis-mcp",
|
|
16
|
-
"version": "0.3.
|
|
16
|
+
"version": "0.3.2",
|
|
17
17
|
"transport": {
|
|
18
18
|
"type": "stdio"
|
|
19
19
|
},
|