You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Version 1.2.0 ships the critical-review fix pass: a non-functional
my_work, an asyncPool rejection leak, a structurally-wrong org_pulse
stale-PR query, GraphQL injection in fetchCommitHistory, and ~25 other
correctness/security findings — plus dryRun preview support on the
destructive mutation tools and a full dependency refresh. Ship the
matching package.json version and changelog entry together.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: CHANGELOG.md
+56Lines changed: 56 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,6 +9,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
9
9
10
10
## [Unreleased]
11
11
12
+
## [1.2.0] — 2026-05-22
13
+
14
+
A correctness, security, and safety pass across the whole tool surface,
15
+
driven by a full critical review. Adds preview (`dryRun`) support to the
16
+
destructive mutation tools and refreshes all dependencies.
17
+
18
+
### Added
19
+
20
+
-**`dryRun`** parameter on **`labels_sync`**, **`release_create`**, and **`workflow_dispatch`** — computes and returns the planned action without mutating GitHub state.
21
+
-**`labels_sync`** now returns a **`failures[]`** array (`{ name, action, error }`) so a partial failure surfaces per label instead of discarding completed work.
22
+
-**`release_create`** returns a **`warnings`** array when both `body` and `generateNotes` are supplied, and pre-checks the tag to return a `VALIDATION` error instead of silently failing when a release already exists.
23
+
-**`release_readiness`** returns **`truncatedCount`** when the compared commit range exceeds the GitHub compare-endpoint cap or `maxCommits`.
24
+
-**`actions_runs_filter`** gained a **`format`** parameter for markdown output, matching the rest of the tool surface.
25
+
-**`gh_auth_status`** now populates **`scopes`** from the `x-oauth-scopes` response header.
26
+
27
+
### Changed
28
+
29
+
-**`pr_comment_batch`** output field **`commentsPosted`** renamed to **`commentsRequested`** — GitHub's review-creation response does not echo created inline comments, so the count is the requested one.
30
+
-**`issue_from_template`** variable substitution is now **`{{ key }}`-only**; the greedy legacy `$key` form (which rewrote tokens like `$100`) was removed.
31
+
-**`labels_sync`** fully paginates the existing label set, so the `deleteExtra` computation is correct for repositories with more than 100 labels.
32
+
-**`fetchPRMetadata`** resolves PRs in batches of 20 instead of truncating at 20.
33
+
-**`repo_status`** and **`release_readiness`** render `pending`/`expected` CI states distinctly instead of collapsing every non-success state to "failing".
34
+
- The coverage gate now fails if any registered tool file is absent from the coverage report, closing a blind spot that hid five zero-coverage tools.
35
+
- All direct and transitive dependencies refreshed to their latest compatible versions.
36
+
37
+
### Fixed
38
+
39
+
-**`my_work`** was non-functional — the GraphQL search queries embedded `$username` inside string literals, so every call failed variable validation. Search strings are now built correctly and `username` is validated against `^[A-Za-z0-9-]+$`.
40
+
-**`org_pulse`** stale-PR detection ordered PRs `UPDATED_AT DESC` and only fetched the first 10, structurally excluding the stalest PRs; it now orders ascending.
41
+
-**`ci_diagnosis`** listed every passing job under "Failed Jobs" on green runs.
42
+
-**`asyncPool`** leaked unhandled rejections and silently shrank effective concurrency when a task rejected.
43
+
-**`pr_preflight`** commit-granularity check ran up to 250 serial `getCommit` calls; these now run through `parallelApi`.
44
+
-**`pin_drift`** head-equality shortcut compared SHAs against tag/branch names, and `package.json` parsing false-matched `file:`/`workspace:`/`link:`/`npm:` specs.
45
+
-**`ecosystem_activity`** threw a `TypeError` (misclassified as `INTERNAL`) for not-found repositories; it now returns `NOT_FOUND`.
46
+
-**`changelog_draft`** emitted sections in map-insertion order instead of `LABEL_ORDER`.
47
+
-**`fetchLatestSemverTag`** picked the first API-ordered tag rather than the highest semver.
48
+
-**`timeAgo`**, **`parseSince`**, and **`extractPRNumbers`** hardened against future/clock-skewed dates, semantically-invalid dates, and unsafe-integer overflow.
49
+
- A non-numeric **`GITHUB_API_PARALLELISM`** value no longer yields unbounded concurrency.
50
+
51
+
### Security
52
+
53
+
-**`fetchCommitHistory`** now passes `since`, `path`, and `limit` as typed GraphQL variables instead of interpolating them into the query string (`path` is partially derived from repository manifest content).
54
+
-**`parseGitHubRemoteUrl`** anchors the host pattern, rejecting homograph URLs such as `github.com.evil.com/a/b`.
- Auth caches (token, REST, and GraphQL clients) invalidate on a genuine HTTP 401 so a rotated token can be re-resolved without a restart.
57
+
58
+
### Tests
59
+
60
+
- Added mocked happy-path coverage for the five previously-untested tools: **`pr_preflight`**, **`ci_diagnosis`**, **`my_work`**, **`org_pulse`**, and **`changelog_draft`**.
61
+
- Added `dryRun`, partial-failure, and error-path tests for the mutation tools, plus infrastructure tests for `asyncPool`, URL anchoring, token scrubbing, and date helpers.
62
+
63
+
### Documentation
64
+
65
+
-**`docs/mcp-tools.md`** updated for every new parameter, output field, and contract change.
0 commit comments