zereight/gitlab-mcp v2.2.6

on GitHub

Changes in v2.2.6

🔐 Security

• fix(auth): bind dynamic project scope to the session (GHSA-qcj2-qcc2-5fg4). With REMOTE_AUTHORIZATION=true and ENABLE_DYNAMIC_PROJECT_SCOPE=true, the X-GitLab-Allowed-Project-Ids scope established at session initialization is now enforced for the whole session: omitting the header keeps the session scope, and a different scope is rejected with 401. Re-initialize the session to change scope. All users of dynamic project scoping should upgrade.

📝 Documentation

• docs: sync server-card version with package.json (2.2.5) #845

Contributors

• @zereight (1 PR: #845)

⚠️ Deprecation notice

Deprecated configuration options (e.g. GITLAB_READ_ONLY_MODE, USE_GITLAB_WIKI, and other legacy flags) still work during the grace period, but they will be removed in v3.0.0. Please migrate to the replacements described in the pinned issue #815.