samanhappy/mcphub v1.0.32

on GitHub

Summary

This release closes the remaining security alerts flagged by CodeQL and Dependabot, including path injection, prototype pollution, rate limiting, SSRF, and OAuth PKCE findings, and hardens the logging pipeline by redacting sensitive data. Log messages are now stringified for better readability.

Fixes

• fix(security): close CodeQL alerts with redacting logger and hardening by @samanhappy in #1065
• fix(security): resolve CodeQL path injection, prototype pollution and rate limiting alerts by @samanhappy in #1066
• fix(security): resolve Dependabot alerts by updating vulnerable transitive dependencies by @samanhappy in #1067
• fix(security): use CodeQL-recognized barrier guards to close remaining 12 alerts by @samanhappy in #1068
• fix(security): close open security advisory findings (SSRF, authz, OAuth PKCE) by @samanhappy in #1069
• fix(logging): stringify log messages for better readability by @samanhappy in #1070

摘要

本版本修复了 CodeQL 和 Dependabot 标记的剩余安全告警，包括路径注入、原型污染、速率限制、SSRF 和 OAuth PKCE 等问题，并通过脱敏日志记录器加固了日志管线。同时，日志消息现在会进行字符串化处理，以便更好地阅读。

修复

• 使用脱敏日志记录器和加固措施关闭 CodeQL 告警 by @samanhappy in #1065
• 修复 CodeQL 路径注入、原型污染和速率限制告警 by @samanhappy in #1066
• 通过更新易受攻击的传递依赖解决 Dependabot 告警 by @samanhappy in #1067
• 使用 CodeQL 可识别的防护屏障关闭剩余 12 个告警 by @samanhappy in #1068
• 关闭未处理的安全公告发现（SSRF、授权、OAuth PKCE）by @samanhappy in #1069
• 字符串化日志消息以提高可读性 by @samanhappy in #1070

References

• fix(security): close CodeQL alerts with redacting logger and hardening by @samanhappy in #1065
• fix(security): resolve CodeQL path injection, prototype pollution and rate limiting alerts by @samanhappy in #1066
• fix(security): resolve Dependabot alerts by updating vulnerable transitive dependencies by @samanhappy in #1067
• fix(security): use CodeQL-recognized barrier guards to close remaining 12 alerts by @samanhappy in #1068
• fix(security): close open security advisory findings (SSRF, authz, OAuth PKCE) by @samanhappy in #1069
• fix(logging): stringify log messages for better readability by @samanhappy in #1070
• Full changelog: v1.0.31...v1.0.32