Security fix for GHSA-9897-5v79-gfvc: startup no longer automatically loads project dotenv files or working-directory YAML. Custom YAML requires an explicit absolute CONFIG_PATH. Docker env_file and explicitly configured launcher environments remain supported.
If you previously relied on automatic dotenv loading, select a trusted env file in your launcher or configure the MCP client's env block.
Reported privately by @tmowbrey. See the security advisory for affected versions and migration guidance.
Run launcher commands from an operator-controlled directory; the launcher and any configuration it loads must also be trusted.
This app release requires Shared >=0.6.17 and Core >=0.4.48.
Install or upgrade:
uvx unifi-network-mcp==0.32.2
What's Changed
Network MCP
- fix(network): use the per-MAC client lookup from Core past the /rest/user cap (#642) by @tmowbrey (1ed216c)
- feat(network): warn on unrecognised UNIFI_POLICY_* variables at startup (#652) by @tmowbrey (2f35106)
- fix: guide callers to accepted MAC argument names (#649) by @tmowbrey (b5c2910)
- feat(network): validate port and client targeting on firewall policies (#646) by @tmowbrey (9ef85e5)
- fix(events): reject negative limits and handle Protect zero locally (#667) by @be-student (56ed98e)
- fix(core): restrict diagnostics to operation metadata (#671) by @tmowbrey (ab60aa4)
- fix(security): require explicit trusted startup configuration by @sirkirby (468be04)
- fix(deps): require startup security fix in MCP applications by @sirkirby (6be4458)
Omitted 5 unrelated monorepo commits from these notes.
New Contributors
- @be-student made their first contribution in #667
Full Changelog: network/v0.32.1...network/v0.32.2