JuliusBrussee/caveman middleware-ts-v1.1.0

@caveman-ai/middleware 1.1.0

on GitHub

• Security: the MCP adapter now requires @modelcontextprotocol/sdk 1.32.0 or
  later. Earlier releases followed redirects to any origin and handed it custom
  headers, and on 307/308 the request body including OAuth tokens
  (GHSA-6prh-2h8m-c8cw).
  With 1.30.x or 1.31.x installed, MCP results pass through uncompressed and a
  warning names the advisory and the version to upgrade to.
• @anthropic-ai/sdk 0.132.0 through 0.137.0 and the 1.x major (tested 1.0.0
  and 1.1.0) are inside the supported range (>=0.124.0 <2). Before this, the
  latest SDK passed content through with an unsupported_version warning.
• Mastra: call options forward again across @mastra/core's vendored
  @ai-sdk/provider types, which lagged the real package and failed tsc.

Verify this release

• Registry provenance (trusted publishing from this workflow): https://www.npmjs.com/package/@caveman-ai/middleware/v/1.1.0#provenance
• CycloneDX SBOM of the published dependency graph: attached .cdx.json
• Built from annotated, GitHub-verified tag middleware-ts-v1.1.0 on main