Security
- The bundled MCP wrapper moves
fast-urito 3.1.5, closing three host-confusion advisories (GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6) in its URI validation — the only advisory-flagged dependency that reaches the shipped wheel. The rest of the wrapper tree (hono,ip-address,@hono/node-server, and via npmoverridesqs,body-parser,esbuild) is pinned to patched versions sonpm auditreports zero; those are tree-shaken out of the shipped bundle and never reached users.
CI hardening
cargo deny check(advisories, bans, licenses) runs on every push and pull request.- A CodeQL workflow analyzes the Python and TypeScript sources.
.github/dependabot.ymlschedules weekly dependency updates across cargo, pip, npm, and GitHub Actions.
No user-facing API changes. Full changelog: CHANGELOG.md