What's Changed
- Harden hosted MCP routes (MJ-001) by @chelojimenez in #5643
- Harden OAuth debugger requests (MJ-001) by @chelojimenez in #5648
- Harden hosted MCP streams (MJ-001) by @chelojimenez in #5649
- Harden conversation history (MJ-009) by @chelojimenez in #5645
- Start browser sessions without a saved profile when it can't load by @chelojimenez in #5646
- Harden response headers (MJ-016) by @chelojimenez in #5647
- Tidy finding references in comments and tests by @chelojimenez in #5644
- Drop case-pass-criteria-section from the em dash legacy list by @chelojimenez in #5665
- Preserve public plugin headers while binding stored credentials by @chelojimenez in #5634
- Release through a version PR instead of pushing to main by @chelojimenez in #5666
- chore: add release changeset for inspector by @chelojimenez in #5668
- Fix local Claude Code pack bootstrap parity by @chelojimenez in #5669
- chore(release): version packages (3.12.3) by @chelojimenez in #5670
Full Changelog: v3.12.2...v3.12.3