agigante80/actual-mcp-server v0.22.46

Release v0.22.46

on GitHub

🎉 Release v0.22.46

📦 Docker Images

# Docker Hub
docker pull agigante80/actual-mcp-server:0.22.46

# GitHub Container Registry
docker pull ghcr.io/agigante80/actual-mcp-server:0.22.46

📝 Changelog

• chore(release): bump version to 0.22.46 (ff30efe)
• fix(dev): make npm run dev and test:mcp-client start again (#565) (5738ff3)
• fix(query): read NOT after a joined field as a keyword, not a column (#566) (0f73a07)
• chore(release): bump version to 0.22.45 (48bd123)
• fix(query): decode SQL-escaped apostrophes in WHERE values, refuse quotes on id columns (#567) (dd66cc7)
• docs(roadmap): open Query parser and launcher fixes (3148746)
• chore(forge-kit): refresh ticket-standards doc, lockstep guard and gate to current markers (e8f75fd)
• docs(roadmap): close the Reporter follow-ups phase as done (de8ec59)

📊 What this release ships

• @actual-app/api pinned at 26.10.0
• All 84 MCP tools registered and validated on this tag

🔒 Security

actual_query_run now refuses a quote character in a WHERE value compared against an id column (#567). Earlier releases passed such a value through to the id comparison, so a crafted filter could reach past the intended literal. Text columns keep supporting quotes, and doubled apostrophes (O''Brien) now decode correctly. Upgrading is recommended for every deployment that exposes actual_query_run.

🙏 Thanks

Thanks to @mikemikimike for #567 and PR #568, which this release integrates (co-authored in dd66cc7).

This release has been scanned for vulnerabilities. Check the Security tab for details.

Full Changelog: v0.22.44...v0.22.46