salesforce-metadata-mcp 2.11.1 → 2.11.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +52 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,57 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [2.11.2] - 2026-08-06
|
|
4
|
+
|
|
5
|
+
### Security — resolved all 5 production-dependency advisories (2 high, 3 moderate)
|
|
6
|
+
|
|
7
|
+
`@modelcontextprotocol/sdk` bumped `1.29.0` → `1.30.0` (minor, non-breaking). Every advisory traced
|
|
8
|
+
back to that one dependency:
|
|
9
|
+
|
|
10
|
+
| Package | Advisory | Severity |
|
|
11
|
+
|---|---|---|
|
|
12
|
+
| `@modelcontextprotocol/sdk` | vulnerable range 1.25.0–1.29.0 | moderate |
|
|
13
|
+
| `@hono/node-server` | path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | moderate |
|
|
14
|
+
| `hono` | ReDoS in CORS middleware via `Access-Control-Request-Headers` | moderate |
|
|
15
|
+
| `ip-address` | leading-zero octet / CIDR-suffix / IPv4-mapped-IPv6 parsing bugs enabling SSRF and trust-boundary bypass (3 advisories) | high |
|
|
16
|
+
| `fast-uri` | host confusion via backslash authority introducer | high |
|
|
17
|
+
|
|
18
|
+
Only two of these actually required a change here. `hono`, `fast-uri`, and `ip-address` sit under
|
|
19
|
+
parent ranges (`^4.11.4`, `^3.0.1`, `^10.2.0`) that already admit their patched versions, so any fresh
|
|
20
|
+
install resolves them safely regardless of what this repo's lockfile happens to pin. `@hono/node-server`
|
|
21
|
+
did not: SDK 1.29.0 constrained it to `^1.19.9`, which cannot reach the patched 2.0.5. SDK 1.30.0
|
|
22
|
+
widens that to `^1.19.9 || ^2.0.5`. The SDK's own advisory needed the bump too.
|
|
23
|
+
|
|
24
|
+
**Note on why the lockfile is not the fix.** This package is a library — consumers resolve from the
|
|
25
|
+
`dependencies` ranges in `package.json` at install time and never see `package-lock.json`. Running
|
|
26
|
+
`npm audit fix` alone would have cleaned the local `npm audit` output while changing nothing for
|
|
27
|
+
anyone installing from npm. The dependency bump is what actually reaches users, and only once
|
|
28
|
+
published.
|
|
29
|
+
|
|
30
|
+
Resolved after the bump: `@modelcontextprotocol/sdk` 1.30.0, `@hono/node-server` 2.1.0, `hono` 4.13.0,
|
|
31
|
+
`fast-uri` 3.1.5, `ip-address` 10.4.0. `npm audit` reports 0 vulnerabilities for both production and
|
|
32
|
+
full trees.
|
|
33
|
+
|
|
34
|
+
Verified beyond the audit output, since the SDK is the protocol layer and a clean `tsc` proves nothing
|
|
35
|
+
about runtime: **stdio** transport handshakes and lists 223 tools; **HTTP** transport (`TRANSPORT=http`)
|
|
36
|
+
serves `/health`, completes an `initialize` over `/mcp`, 404s unknown paths, and still binds
|
|
37
|
+
`127.0.0.1` by default (the v2.8.8 hardening is intact — this mattered to check, as the changed
|
|
38
|
+
packages are exactly the ones behind that transport); and a real `tools/call` round-trip dispatches
|
|
39
|
+
through zod validation into the handler, failing only at the expected credentials boundary.
|
|
40
|
+
|
|
41
|
+
### Fixed — server advertised a stale hardcoded version to MCP clients
|
|
42
|
+
|
|
43
|
+
`src/index.ts` hardcoded the version in four places (`McpServer` init, both startup banners, the
|
|
44
|
+
`/health` payload) and was never bumped for v2.11.0 or v2.11.1, so the server reported **2.10.0** in
|
|
45
|
+
its `initialize` response while `package.json` said 2.11.1. Now read from `package.json` at runtime via
|
|
46
|
+
`createRequire(import.meta.url)`, so it cannot drift again. A direct JSON import is not viable here:
|
|
47
|
+
`package.json` sits outside `tsconfig`'s `rootDir` (`./src`), so importing it would restructure `dist/`.
|
|
48
|
+
|
|
49
|
+
### Docs
|
|
50
|
+
|
|
51
|
+
Corrected the tool count in `QUICKSTART.md` (212 → 223) and in the GitHub repository description
|
|
52
|
+
(212 → 223). Both had drifted for the same reason: neither ships in the npm tarball, so publishing
|
|
53
|
+
never surfaces them the way it does `README.md`/`TOOLS.md`/`package.json`.
|
|
54
|
+
|
|
3
55
|
## [2.11.1] - 2026-08-03
|
|
4
56
|
|
|
5
57
|
### Fixed — `sf_retrieve_metadata` reported success on zero-result retrieves, plus two dead parameters found while investigating
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "salesforce-metadata-mcp",
|
|
3
|
-
"version": "2.11.
|
|
3
|
+
"version": "2.11.2",
|
|
4
4
|
"description": "The only Salesforce MCP with Agentforce, OmniStudio & DevOps Center tools — 223 tools total: objects, flows, Apex (create + read), schema describe, debug logs, permissions, reports, Experience Cloud, Einstein AI.",
|
|
5
5
|
"mcpName": "io.github.semwalajay83-sem/salesforce-metadata-mcp",
|
|
6
6
|
"license": "MIT",
|
|
@@ -108,7 +108,7 @@
|
|
|
108
108
|
"forecast-hierarchy"
|
|
109
109
|
],
|
|
110
110
|
"dependencies": {
|
|
111
|
-
"@modelcontextprotocol/sdk": "1.
|
|
111
|
+
"@modelcontextprotocol/sdk": "1.30.0",
|
|
112
112
|
"cross-spawn": "^7.0.6",
|
|
113
113
|
"jszip": "3.10.1",
|
|
114
114
|
"zod": "3.25.76"
|