5a1546c407
deps: bump @clack/prompts from 0.7.0 to 1.7.0
...
Bumps [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts ) from 0.7.0 to 1.7.0.
- [Release notes](https://github.com/bombshell-dev/clack/releases )
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md )
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.7.0/packages/prompts )
---
updated-dependencies:
- dependency-name: "@clack/prompts"
dependency-version: 1.7.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-17 12:08:25 +00:00
0fce6f4008
Merge main into feat/mcp-sdk-v2; bump to 0.16.0
...
Lock regenerated from the v2 dependency set (nanoid advisory clear),
dist rebuilt, 279 tests green.
2026-08-17 12:41:18 +02:00
2ac3d8b97a
fix: bump nanoid past GHSA-2v37-7h3g-55p8
2026-08-17 12:34:40 +02:00
071678e52a
feat: preview MCP SDK v2 dual-era support
2026-08-15 11:11:46 +02:00
94121bfd80
fix(deploy): prepare staging for main merge
2026-08-13 13:55:17 +02:00
2074ba532b
deps: bump tsx from 4.23.9 to 4.23.10 in the minor-and-patch group
...
Bumps the minor-and-patch group with 1 update: [tsx](https://github.com/privatenumber/tsx ).
Updates `tsx` from 4.23.9 to 4.23.10
- [Release notes](https://github.com/privatenumber/tsx/releases )
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs )
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.9...v4.23.10 )
---
updated-dependencies:
- dependency-name: tsx
dependency-version: 4.23.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-10 12:06:36 +00:00
b10a5b2d7a
feat: add read-only server mode
2026-08-09 11:18:53 +02:00
272888b9d0
fix(security): block hidden vault paths
2026-08-08 19:24:51 +02:00
c1b997dbc6
docs: prepare 0.14.0 release
2026-08-08 18:58:00 +02:00
4528a7d3b8
chore: bump to 0.13.0, update tool count 16→18 across docs
...
get_note_outline and read_note_lines bring the total to 18 tools.
Updated README's toolkit list (was also missing both new tools from the
enumeration, not just the count), website/AGENTS.md's own pointer note,
features.md, and FeatureGrid.astro. website/public/llm.txt and
how-it-works.md no longer state a count as of this pass - not touched.
2026-08-06 15:32:58 +00:00
a27b585a26
chore: prepare 0.12.6 dependency refresh
2026-08-06 15:16:40 +02:00
74bd9ad10b
fix: refresh audited transitive dependencies
2026-08-05 15:11:15 +02:00
e8187d7c1b
deps: bump typescript from 6.0.3 to 7.0.2
...
Bumps [typescript](https://github.com/microsoft/TypeScript ) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases )
- [Commits](https://github.com/microsoft/TypeScript/commits )
---
updated-dependencies:
- dependency-name: typescript
dependency-version: 7.0.2
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-07-30 12:27:04 +00:00
cf92712ca5
fix: exit when stdio transport closes ( #159 )
...
StdioServerTransport only listens for stdin 'data'/'error'; it never
wires up 'end'/'close', so the process never learns when the client
disconnects. Hosts with no MCP lifecycle controls (e.g. Codex 0.146.x)
left orphaned processes accumulating with nothing to reap them.
Exit gracefully via server.close() on stdin EOF and on SIGTERM/SIGINT.
2026-07-30 13:24:50 +02:00
9353134f02
chore: bump version to 0.12.4
2026-07-23 12:00:38 +02:00
391ae23444
chore: bump version to 0.12.3
2026-07-23 11:58:23 +02:00
84cd2f629a
chore: bump version to 0.12.2
...
Includes dist rebuild for #151 (normalizePath) and #153
(patch_note $-pattern fix).
2026-07-23 11:38:07 +02:00
487105d426
deps: bump the minor-and-patch group across 1 directory with 3 updates
...
Bumps the minor-and-patch group with 3 updates in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ), [tsx](https://github.com/privatenumber/tsx ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `@types/node` from 26.0.0 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
Updates `tsx` from 4.22.4 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases )
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs )
- [Commits](https://github.com/privatenumber/tsx/compare/v4.22.4...v4.23.1 )
Updates `vitest` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 26.1.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: tsx
dependency-version: 4.23.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: vitest
dependency-version: 4.1.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-07-23 09:32:25 +00:00
0d7bf63cfa
fix: clear npm audit high-severity findings
...
npm audit fix for body-parser, fast-uri, hono and the js-yaml install
still nested under gray-matter (now 3.15.0, patched). Lockfile-only.
@hono/node-server stays moderate: @modelcontextprotocol/sdk pins 1.x
and the fix needs 2.0.5; below the --audit-level=high CI gate.
2026-07-23 11:06:30 +02:00
ed18307c20
chore: bump version to 0.12.1
...
Ships js-yaml CVE fix (CVE-2023-44270) via gray-matter engine swap.
2026-06-23 21:01:36 +02:00
f1a57c6842
deps: bump @types/node from 25.9.3 to 26.0.0
...
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 25.9.3 to 26.0.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 26.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-06-22 12:06:08 +00:00
e431252990
release: 0.12.0 ( #142 )
...
Minor release: search_notes pathPrefix/excludePaths (#126 ).
2026-06-18 23:22:25 +02:00
107bdccf19
deps: bump the minor-and-patch group across 1 directory with 4 updates ( #135 )
...
Bumps the minor-and-patch group with 4 updates in the / directory: [yaml](https://github.com/eemeli/yaml ), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ), [typescript](https://github.com/microsoft/TypeScript ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `yaml` from 2.8.3 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases )
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.3...v2.9.0 )
Updates `@types/node` from 25.6.0 to 25.9.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
Updates `typescript` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases )
- [Commits](https://github.com/microsoft/TypeScript/compare/v6.0.2...v6.0.3 )
Updates `vitest` from 4.1.4 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest )
---
updated-dependencies:
- dependency-name: yaml
dependency-version: 2.9.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@types/node"
dependency-version: 25.9.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: typescript
dependency-version: 6.0.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: vitest
dependency-version: 4.1.9
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-18 22:26:48 +02:00
8795716b90
Merge commit from fork
...
PathFilter only denied .git/.obsidian/node_modules at the vault root because
the glob patterns are anchored. Nested copies (tools/cli/node_modules/...,
tools/repo/.git/config, nested .obsidian) were traversable: nested
node_modules polluted listAllTags with garbage tags, and nested .git/.obsidian
exposed their contents (incl. .git/config credentials) under the same
prompt-injection threat model as the case-equivalence bypass.
Deny these restricted names as ANY path segment (case-insensitive), in
addition to the existing glob patterns. Legit paths that merely contain the
substring (gitignore-tips.md, my-node_modules-notes.md) stay allowed. +5 tests.
Bumps to 0.11.5.
2026-06-18 22:15:53 +02:00
b9ea91a1c6
Merge commit from fork
...
PathFilter compiled deny-list patterns case-sensitively and matched the
path verbatim, so on case-insensitive filesystems (macOS, Windows) names
like .Git/config, .GIT/config, or .oBsIdIaN/secrets.md slipped past the
restriction while the OS opened the real .git/.obsidian file. Windows
trailing dots/spaces (.git./config, .git /config) bypassed it the same way.
Match case-insensitively and canonicalize each path segment (strip trailing
dots/spaces, drop ./ and empty segments) before checking the deny-list.
Covers isAllowed and isAllowedForListing. Adds the full bypass matrix as
tests. (CWE-178 / CWE-41)
2026-06-17 19:42:53 +02:00
cbf70c5a49
fix: guard undefined/non-string path in PathFilter ( closes #107 ) ( #132 )
...
* fix: guard undefined/non-string path in PathFilter (closes #107 )
read_note/write_note (and patch/delete/move) threw an unguarded TypeError
'Cannot read properties of undefined (reading 'replace')' when invoked
without a path. Add a typeof guard in PathFilter.isAllowed and
isAllowedForListing that returns a clear 'path is required and must be a
string' error instead. Covers all callers in one place. Adds 3 tests.
* chore: bump version to 0.11.3
Ships the #107 PathFilter undefined-path guard. Patch release.
2026-06-17 18:51:03 +02:00
f3640ad08e
deps: npm audit fix (12 -> 2 vulnerabilities) ( #133 )
...
* deps: npm audit fix (12 -> 2 vulnerabilities)
Non-breaking transitive bumps via npm audit fix. Clears 10 of 12
advisories (hono, @hono/node-server, fast-uri, ip-address,
express-rate-limit, path-to-regexp, qs, vite, esbuild/tsx), all pulled
transitively through @modelcontextprotocol/sdk and dev tooling.
Lockfile-only; package.json unchanged. 180 tests pass, build green.
Remaining 2 (moderate): js-yaml DoS via gray-matter. Not fixed here
because js-yaml's patched line (4.2.0) is incompatible with gray-matter@4
(breaks frontmatter parsing). Needs a separate change (swap gray-matter's
YAML engine to the already-present 'yaml' dep, or replace gray-matter).
* Update ci.yml
2026-06-17 18:17:44 +02:00
488a9076f8
Add trashMode support to delete_note
...
- none (default): permanent delete (previous behavior)
- local: move to .trash/ inside vault, preserving folder structure
- system: move to OS trash via the trash package
- Add trashMode parameter to tool schema, types, and handler
- Add tests for local and system trash modes
- Update docs: CHANGELOG, README, website
2026-05-25 21:49:39 +02:00
764a477b06
deps: bump typescript from 5.9.3 to 6.0.2
...
Bumps [typescript](https://github.com/microsoft/TypeScript ) from 5.9.3 to 6.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases )
- [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.2 )
---
updated-dependencies:
- dependency-name: typescript
dependency-version: 6.0.2
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:14 +02:00
c62cd7a158
deps: bump the minor-and-patch group across 1 directory with 3 updates
...
Bumps the minor-and-patch group with 3 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk ), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `@modelcontextprotocol/sdk` from 1.27.1 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases )
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.27.1...v1.29.0 )
Updates `@types/node` from 25.5.0 to 25.5.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
Updates `vitest` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest )
---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
dependency-version: 1.29.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@types/node"
dependency-version: 25.5.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: vitest
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:14 +02:00
6e16b482a5
Fix frontmatter formatting loss with AST-aware YAML preservation
...
- Add preserveStringify() using yaml.parseDocument for AST-aware updates
- Only modified keys are rewritten; unmodified fields keep raw formatting
- Fixes YYYY-MM-DD dates becoming ISO timestamps (#77 )
- Fixes HH:MM values parsed as sexagesimal integers (#75 )
- Fixes quoted strings losing their quote style (#76 )
- Applies to update_frontmatter, manage_tags, and write_note append/prepend
2026-05-25 21:49:14 +02:00
7b9c87d2e2
chore: update lockfile and add v0.11.0 newsletter draft
2026-05-25 21:49:14 +02:00
c647fa01ee
feat: markdown newsletter system with Resend Broadcasts
2026-05-25 21:49:13 +02:00
0d3843b34d
deps: bump the minor-and-patch group with 2 updates
...
Bumps the minor-and-patch group with 2 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `@types/node` from 25.3.5 to 25.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
Updates `vitest` from 4.0.18 to 4.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.5.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: vitest
dependency-version: 4.1.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:13 +02:00
6b7f034772
fix: update npm badge URLs for scoped package and fix package-lock bin entry
2026-05-25 21:49:12 +02:00
76f22102e1
chore: bump version to 0.9.0
...
Package rename to @bitbonsai/mcpvault is a breaking change for users with hardcoded npx mcpvault configs.
2026-05-25 21:49:11 +02:00
715501c9c5
chore: bump version to 0.8.3
...
Version bump required for npm publish after package rename to @bitbonsai/mcpvault.
2026-05-25 21:49:11 +02:00
200644f16c
fix: update hono to 4.12.7+ to resolve prototype pollution vulnerability
...
https://claude.ai/code/session_013WJXh3NsRy49Um7i9V7D1Q
2026-05-25 21:49:11 +02:00
626e2ff88d
deps: bump @types/node in the minor-and-patch group
...
Bumps the minor-and-patch group with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ).
Updates `@types/node` from 25.3.3 to 25.3.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.3.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:11 +02:00
445af9a090
feat: default vault path to cwd and bump v0.8.2
...
Allow CLI startup without a vault argument by defaulting to the current working directory, and update core docs/version metadata for the 0.8.2 release.
2026-05-25 21:49:10 +02:00
1b70a492bd
deps: bump @types/node from 24.10.1 to 25.3.3
...
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 24.10.1 to 25.3.3.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.3.3
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:10 +02:00
36edca3cab
deps: bump @modelcontextprotocol/sdk in the minor-and-patch group
...
Bumps the minor-and-patch group with 1 update: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk ).
Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.27.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases )
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.26.0...v1.27.1 )
---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
dependency-version: 1.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:10 +02:00
3f74d84384
fix: update lockfile to resolve npm audit advisories
2026-05-25 21:49:10 +02:00
fd0ebc97c9
fix: apply npm audit lockfile updates
2026-05-25 21:49:09 +02:00
71602caea0
release: prepare v0.8.1 with compatibility and docs updates
2026-05-25 21:49:09 +02:00
768bb9a076
deps: bump vitest in the minor-and-patch group across 1 directory ( #39 )
...
Bumps the minor-and-patch group with 1 update in the / directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `vitest` from 4.0.16 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/vitest )
---
updated-dependencies:
- dependency-name: vitest
dependency-version: 4.0.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-25 21:49:09 +02:00
976435a394
fix security vulnerabilities in @modelcontextprotocol/sdk, hono, qs
2026-05-25 21:49:08 +02:00
5a01eef01d
bump version to 0.7.5, update changelog and LLM docs
2026-05-25 21:49:08 +02:00
9fa1637dba
Modified package.json
2026-05-25 21:49:07 +02:00
3e6b6321ae
fix: sync package-lock.json with package.json for CI compatibility
...
Regenerated package-lock.json to include all optional platform-specific
dependencies (@esbuild/* and @rollup/*) that were missing after the Node 24
migration. CI was failing because npm ci requires the lockfile to be
complete and in sync.
2026-05-25 21:49:07 +02:00
dependabot[bot]