agigante80/actual-mcp-server v0.22.47 on GitHub

🎉 Release v0.22.47

# Docker Hub
docker pull agigante80/actual-mcp-server:0.22.47

# GitHub Container Registry
docker pull ghcr.io/agigante80/actual-mcp-server:0.22.47

Applies only when AUTH_PROVIDER=oidc and a principal's AUTH_BUDGET_ACL entry is a list of sync ids rather than ["*"]:

actual_budgets_list_available and actual_budgets_get_all now return only the budgets in that principal's list.
actual_budgets_import is refused for a restricted principal (Budget ACL: error), because the budget an import creates belongs to no one's list.
Refusal and switch errors are terser: they no longer name budgets outside the list or any sync id. A switch to a denied budget returns the same not-found error as an unknown name.
An OIDC request with no allowedBudgets in context is refused the registry listing (fails closed).

Wildcard OIDC principals, MCP_SSE_AUTHORIZATION bearer, MCP_ALLOW_UNAUTHENTICATED and stdio callers are unchanged.

Thanks to @jospaquim, whose PR #569 surfaced this gap during review.

test(e2e): read the get_all array directly in the #570 listing row (18c0550)
chore(release): bump version to 0.22.47 (65f8b80)
fix(security): apply the budget ACL to listings, import and error text (#570) (51acf0c)
docs(roadmap): open the Multi-client isolation phase (#570, #571, #572) (04ef0d6)
docs(roadmap): close the Query parser and launcher fixes phase as done (00941bc)

This release has been scanned for vulnerabilities. Check the Security tab for details.

Full Changelog: v0.22.46...v0.22.47