e355221145
Package-lock CI compatibility push (node 24)
2026-05-25 21:49:07 +02:00
57ba8edeba
Bump version to 0.7.3
...
Changes:
- Fix folder detection for paths with dots in folder names (PR #15 )
- Update dependencies: MCP SDK 1.25.1, tsx 4.21.0, vitest 4.0.16 (PR #17 )
- Update @types/node to 24.10.1 (PR #14 )
- Remove inaccurate link handling claim from README
All tests passing (206 tests)
2026-05-25 21:49:07 +02:00
fe3202a394
Fix lockfile peer dependency flags
...
Remove incorrect "peer": true flags added by Dependabot.
These flags are not correct and cause lockfile validation to fail in CI.
2026-05-25 21:49:07 +02:00
995c77a04f
deps: bump the minor-and-patch group across 1 directory with 3 updates
...
Bumps the minor-and-patch group with 3 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk ), [tsx](https://github.com/privatenumber/tsx ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `@modelcontextprotocol/sdk` from 1.24.3 to 1.25.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases )
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/1.24.3...1.25.1 )
Updates `tsx` from 4.20.6 to 4.21.0
- [Release notes](https://github.com/privatenumber/tsx/releases )
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs )
- [Commits](https://github.com/privatenumber/tsx/compare/v4.20.6...v4.21.0 )
Updates `vitest` from 4.0.15 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/vitest )
---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
dependency-version: 1.25.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: tsx
dependency-version: 4.21.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: vitest
dependency-version: 4.0.16
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:06 +02:00
fc4633b070
Fix lockfile peer dependency flags
...
Remove incorrect "peer": true flags added by Dependabot.
These flags are not correct and cause lockfile validation to fail in CI.
2026-05-25 21:49:06 +02:00
f01529f77d
deps: bump @types/node from 20.19.21 to 24.10.1
...
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 20.19.21 to 24.10.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 24.10.1
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-25 21:49:06 +02:00
d48f9895dd
Update package-lock.json for v0.7.2
2026-05-25 21:49:06 +02:00
fa776ffcab
fix(security): address CodeQL, OpenSSF Scorecard, and npm audit findings ( #12 )
...
* ci(security): add CodeQL static analysis workflow
Automated detection of security vulnerabilities in TypeScript code
(path traversal, injection, prototype pollution) to protect users'
personal vault data.
Uses security-extended queries and runs weekly to catch new CVEs.
Ref: https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql
* ci: add CI workflow with security checks
Prevent supply chain attacks through compromised dependencies by
validating lockfile integrity and running npm audit on every PR.
Lockfile validation detects dependency confusion attacks where
package-lock.json diverges from declared dependencies.
Refs:
- https://docs.npmjs.com/cli/v10/commands/npm-audit
- https://blog.npmjs.org/post/626173315965468672/npm-v7-series-why-keep-package-lockjson
* ci: add Dependabot for automated security updates
Ensure known vulnerabilities (CVEs) in dependencies are patched
promptly without manual tracking.
Major updates stay as separate PRs for careful review of breaking changes.
Ref: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
* ci: add publish workflow with npm provenance
Allow users to verify that npm packages were built from this exact
GitHub repository and commit, not from a compromised machine.
Verification: npm audit signatures
Requires NPM_TOKEN secret in repository settings.
Ref: https://docs.npmjs.com/generating-provenance-statements
* ci: add OpenSSF Scorecard for security posture tracking
Automated evaluation of security practices (branch protection,
dependency updates, signed releases, etc.) with results visible
in GitHub Security tab.
Helps identify gaps in project security hygiene.
Ref: https://securityscorecards.dev/
* deps: fix npm audit vulnerabilities
Upgrade vitest 1.6.1 → 4.0.15 to resolve transitive vite/esbuild
vulnerabilities. Sync lockfile with package.json 0.7.0.
Refs:
- https://github.com/advisories/GHSA-w48q-cv73-mx4w
- https://github.com/advisories/GHSA-mh29-5h37-fv8m
- https://github.com/advisories/GHSA-67mh-4wv8-2f99
* fix(security): eliminate TOCTOU race conditions
Remove check-then-act patterns that were flagged by CodeQL as
js/file-system-race vulnerabilities.
Instead of access() followed by readFile/unlink/etc, handle ENOENT
errors directly from the operation. Use writeFile with 'wx' flag
for atomic "create if not exists" in moveNote().
Ref: https://cwe.mitre.org/data/definitions/367.html
* fix(security): escape regex special chars in glob patterns
The glob-to-regex conversion wasn't escaping special regex characters,
allowing patterns with characters like . + $ etc to be misinterpreted.
Also normalizes backslashes in patterns for Windows compatibility.
Ref: https://codeql.github.com/codeql-query-help/javascript/js-incomplete-sanitization/
* test(security): use mkdtemp for unpredictable temp directories
Predictable paths in /tmp are vulnerable to symlink attacks.
mkdtemp creates directories with random suffixes, preventing
local attackers from pre-creating malicious symlinks.
Ref: https://codeql.github.com/codeql-query-help/javascript/js-insecure-temporary-file/
* docs: add security policy
Define responsible disclosure process, security scope, and response
timelines for vulnerability reports.
Documents implemented security controls and clarifies what's in/out
of scope for this project vs upstream (MCP protocol, Obsidian).
Ref: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
2026-05-25 21:49:06 +02:00
f1827cc535
build files update after bumping to 0.6.5
2026-05-25 21:48:55 +02:00
38e9a16505
Add built files for v0.6.3
2026-05-25 21:48:55 +02:00
1ac395eb69
Remove .npmrc from version control and update .gitignore
...
- Remove .npmrc from git tracking to prevent auth token exposure
- Add .npmrc to .gitignore for security
- Update package-lock.json with peer dependency changes
2026-05-25 21:48:54 +02:00
182deac629
Bump version to 0.6.1
...
## Changes
- Add comprehensive tests for patch_note feature (16 tests)
- Single/multiple occurrence handling
- Empty string validation
- Special characters and whitespace preservation
- Case sensitivity
- Performance testing
- Add validation for empty oldString/newString in patchNote
- Reorganize test structure
- Move tests from tests/ to src/ (co-location)
- Merge filesystem, patch, and integration tests into src/filesystem.test.ts
- Move frontmatter tests to src/frontmatter.test.ts
All 38 tests passing
2026-05-25 21:48:54 +02:00
9d52ecf6b9
Fix YAML frontmatter operations and add comprehensive tests
...
- Remove js-yaml dependency and use gray-matter for all YAML operations
- Fix write_note, update_frontmatter, and manage_tags YAML serialization errors
- Add comprehensive integration tests for all frontmatter operations
- Tests cover write_note with frontmatter, append/prepend modes, update operations
- Tests cover tag management (add, remove, list) and edge cases
- All 22 tests now passing including frontmatter validation
- Version bump to 0.5.4
Resolves: 'yaml.dump is not a function' error in all frontmatter tools
2026-05-25 21:48:53 +02:00
4be5df041d
new package-lock.json
2026-05-25 21:48:53 +02:00
f7a67440ed
bumped version
2026-05-25 21:48:52 +02:00
848ce6367c
Fix usage message in compiled JavaScript output
...
Update error message to show correct npx command instead of referencing server.ts file directly.
2026-05-25 21:48:52 +02:00
1161db9ddb
Convert project from Bun to npm/Node.js
...
- Replace Bun scripts with npm equivalents using tsx and vitest
- Convert Bun.file(), Bun.write(), Bun.Glob(), and Bun.YAML APIs to Node.js equivalents
- Update dependencies: remove @types/bun, add Node.js tooling (tsx, typescript, vitest, js-yaml)
- Add TypeScript configuration and Vitest test config
- Update shebang and usage messages from bun to node
- Maintain backward compatibility for all MCP server functionality
- All tests passing after conversion
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com >
2026-05-25 21:48:52 +02:00
Mauricio Wolff