smart-web-mcp 1.10.11 → 1.10.12

package/CHANGELOG.md

@@ -7,6 +7,10 @@ The format is based on Keep a Changelog[^1] and this project uses SemVer.
 ## Unreleased
 * Protect screenshot/download artifacts with native private directory permissions before publication, including Windows ACLs, and validate containment with canonical native paths (#950).
 * Enforce native Windows private-file ACLs for exports, settings staging and canary locks; preserve existing parent permissions (#941). See [private local files](docs/private-files.md).
+* Check encoded traversal export containment using canonical native paths on Windows and POSIX, without weakening existence or escape coverage (#942).
+* Close owned MCP test transports before deleting their temporary package installation; validate cleanup ownership and bound Windows sharing retries (#945).
+* Make browser cancellation/late-connector regressions advance a controlled clock only after the intended phase begins, retaining cleanup and first-outcome assertions under suite load (#947).
+* Consolidate case-colliding PR templates while retaining checks, traceability and release guidance. Add a tracked-path case-collision gate so fresh Windows checkouts remain clean. See #936.
 * Execute npm through its JavaScript CLI on Windows for metadata/package checks, keeping arguments literal without a command shell.
 * Add an opt-in evidence-oriented smartfetch MCP view with a validated envelope and explicit outcome/coverage. Preserve source content and legacy diagnostics while avoiding repeated transport data. Extract prose from Next.js Flight children instead of promoting shell/import records as articles. See [MCP evidence](docs/mcp-evidence.md) and #922.
 * Try existing captures for weak known-paywall originals or explicit paywall previews before automatic browser/relay recovery, so an origin login wall cannot preempt independent archive acquisition. Reserve browser time after failed early archive discovery and do not repeat it; preserve explicit browser/profile requests, origin cooldowns, network guards and historical provenance. Live archive429/timeouts remain retrieval failures.
@@ -483,6 +487,13 @@ The format is based on Keep a Changelog[^1] and this project uses SemVer.
 - Korean public API helpers now validate outbound URLs and redirects before fetching, blocking localhost, private, and reserved targets unless `network.allowPrivateHosts` is explicitly enabled.
 - CI now declares read-only default repository permissions, Dependabot auto-merge pins the reusable workflow without forwarding all caller secrets, and the workflow check enforces those guards.
 
+## [1.10.12](https://github.com/jojo-labs/smart-web/compare/v1.10.11...v1.10.12) (2026-10-25)
+
+
+### Bug Fixes
+
+* reject case-colliding repository paths ([#940](https://github.com/jojo-labs/smart-web/issues/940)) ([ddfe556](https://github.com/jojo-labs/smart-web/commit/ddfe5560e38f99a0f5eec3fae21964dc40c84fc4))
+
 ## [1.10.11](https://github.com/jojo-labs/smart-web/compare/v1.10.10...v1.10.11) (2026-10-25)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "smart-web-mcp",
   "mcpName": "io.github.jojo-labs/smart-web",
-  "version": "1.10.11",
+  "version": "1.10.12",
   "packageManager": "npm@11.13.0",
   "description": "Local MCP for web search, direct-URL fetch, site crawling, docs export, and bounded smartbrowser local browser actions.",
   "homepage": "https://github.com/jojo-labs/smart-web",
@@ -68,7 +68,7 @@
     "dev:mcp": "node dist/dev.js",
     "dev:watch": "tsc -p tsconfig.json --watch --preserveWatchOutput",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node --import tsx --test src/npm-process.test.ts src/mcp-evidence.test.ts src/reddit-continuation.test.ts src/reddit-practical.test.ts src/browser-continuation.test.ts src/generic-discussion.test.ts src/github-discussion.test.ts src/blind-post.test.ts src/cli-fetch-options.test.ts src/body-export.test.ts src/private-files.test.ts src/assessment.test.ts src/browser-session.test.ts src/shared.test.ts src/extraction.test.ts src/assets.test.ts src/dev-runtime.test.ts src/release-scripts.test.ts src/provider-benchmark-script.test.ts src/smartsearch-quality-benchmark-script.test.ts src/no-secret-surface-watchdog-script.test.ts src/partial-handoff-watchdog-script.test.ts src/render.test.ts src/providers.test.ts src/hackernews-recovery.test.ts src/smartcrawl.test.ts src/smartcrawl-export.test.ts src/provider-policy.test.ts src/archive-fallback.test.ts src/mcp.test.ts src/korea/korea.test.ts src/korea/coupang-recovery.test.ts src/search-browser.test.ts src/search-integrity.test.ts src/fetch-isolation.test.ts src/fetch-deadline.test.ts src/search-quality.test.ts src/smartbrowser.test.ts src/browser-participation.test.ts src/retirement.test.ts src/dcinside-comments.test.ts src/ppomppu-comments.test.ts src/clien-comments.test.ts src/naver-blog.test.ts src/naver-cafe.test.ts src/operator-canary.test.ts src/operator-canary-cli.test.ts src/operator-cdp.test.ts src/operator-cancellation.test.ts src/operator-restart.test.ts",
+    "test": "node --import tsx --test src/npm-process.test.ts src/mcp-evidence.test.ts src/reddit-continuation.test.ts src/reddit-practical.test.ts src/browser-continuation.test.ts src/generic-discussion.test.ts src/github-discussion.test.ts src/blind-post.test.ts src/cli-fetch-options.test.ts src/body-export.test.ts src/private-files.test.ts src/assessment.test.ts src/browser-session.test.ts src/shared.test.ts src/extraction.test.ts src/assets.test.ts src/dev-runtime.test.ts src/release-scripts.test.ts src/provider-benchmark-script.test.ts src/smartsearch-quality-benchmark-script.test.ts src/no-secret-surface-watchdog-script.test.ts src/partial-handoff-watchdog-script.test.ts src/render.test.ts src/providers.test.ts src/hackernews-recovery.test.ts src/smartcrawl.test.ts src/smartcrawl-export.test.ts src/provider-policy.test.ts src/archive-fallback.test.ts src/mcp.test.ts src/korea/korea.test.ts src/korea/coupang-recovery.test.ts src/search-browser.test.ts src/search-integrity.test.ts src/fetch-isolation.test.ts src/fetch-deadline.test.ts src/search-quality.test.ts src/smartbrowser.test.ts src/browser-participation.test.ts src/retirement.test.ts src/dcinside-comments.test.ts src/ppomppu-comments.test.ts src/clien-comments.test.ts src/naver-blog.test.ts src/naver-cafe.test.ts src/operator-canary.test.ts src/operator-canary-cli.test.ts src/operator-cdp.test.ts src/operator-cancellation.test.ts src/operator-restart.test.ts src/case-paths.test.ts",
     "test:bun:fast": "bun test src/extraction.test.ts src/assets.test.ts",
     "test:e2e": "node --import tsx --test src/packaged-mcp.test.ts",
     "test:browser": "node --import tsx --test --test-concurrency=1 src/operator-browser.e2e.test.ts src/browser-actions.e2e.test.ts src/dcinside-pages.e2e.test.ts src/naver-cafe.e2e.test.ts src/operator-cancellation.e2e.test.ts src/reddit-continuation.e2e.test.ts",
@@ -77,8 +77,9 @@
     "check:meta": "node scripts/check-toolchain.mjs && node scripts/check-metadata.mjs",
     "check:workflow": "node scripts/verify-release-workflow.mjs",
     "check:smoke": "npm run typecheck && npm run check:meta && npm run check:workflow",
-    "check": "npm run build && npm run check:meta && npm run check:workflow && npm run test && npm run test:e2e",
-    "prepare": "npm run build"
+    "check": "npm run build && npm run check:meta && npm run check:paths && npm run check:workflow && npm run test && npm run test:e2e",
+    "prepare": "npm run build",
+    "check:paths": "node scripts/check-case-paths.mjs"
   },
   "keywords": [
     "mcp",

package/python/requirements-undetected-chromedriver.txt

@@ -1,3 +1,3 @@
 undetected-chromedriver==3.5.5
 selenium==4.51.0
-setuptools==84.0.0
+setuptools==84.1.0