Security fix for GHSA-9897-5v79-gfvc: startup no longer automatically loads project dotenv files or working-directory YAML. Custom YAML requires an explicit absolute CONFIG_PATH. Docker env_file and explicitly configured launcher environments remain supported.
If you previously relied on automatic dotenv loading, select a trusted env file in your launcher or configure the MCP client's env block.
Reported privately by @tmowbrey. See the security advisory for affected versions and migration guidance.
Run launcher commands from an operator-controlled directory; the launcher and any configuration it loads must also be trusted.
This app release requires Shared >=0.6.17 and Core >=0.4.48.
Install or upgrade:
uvx unifi-protect-mcp==0.8.3
What's Changed
Protect MCP
- feat(network): warn on unrecognised UNIFI_POLICY_* variables at startup (#652) by @tmowbrey (2f35106)
- fix(events): reject negative limits and handle Protect zero locally (#667) by @be-student (56ed98e)
- fix(core): restrict diagnostics to operation metadata (#671) by @tmowbrey (ab60aa4)
- fix(security): require explicit trusted startup configuration by @sirkirby (468be04)
- fix(deps): require startup security fix in MCP applications by @sirkirby (6be4458)
Omitted 8 unrelated monorepo commits from these notes.
New Contributors
- @be-student made their first contribution in #667
Full Changelog: protect/v0.8.2...protect/v0.8.3