GoldenMatch

v3.10.0 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 20h Data Pipelines & ETL

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

data-cleaning data-engineering data-matching data-quality deduplication entity-resolution

+14 more

fellegi-sunter fuzzy-matching knowledge-graph llm master-data-management mcp-server polars pprl python record-linkage rust splink typescript zero-config

Affected surfaces

auth rce_ssrf

Summary

AI summary

mcp_tools.ts_only removed, making TS MCP surface a strict subset; file tools now document containment behavior based on GOLDENMATCH_ALLOWED_ROOT.

Full changelog

Added

3 host-helper MCP tools (server_info, read_file, write_csv) -- the last
ts_only entries. mcp_tools.ts_only is now EMPTY: the TS MCP surface is a
strict subset of the Python one (83 shared, 0 TS-only, 7 Python-only). goldenmatch
MCP tools 87 -> 90. server_info.tool_count is DERIVED from the live tool list,
never a literal, so it cannot drift from the real surface.

Security note (behavior unchanged, now documented + tested)

read_file / write_csv route through the same core._paths.safe_path guard every
other file-taking tool uses. That guard rejects NUL bytes and resolves the path, but
enforces containment only when GOLDENMATCH_ALLOWED_ROOT is set. With it unset
(the default) these tools reach anything the server process can -- identical to the
pre-existing upload_dataset / export_results, so this adds no new reach. Both
modes are now pinned by tests, and the contract is stated on the API-surface page.
write_csv additionally refuses anything that is not a list of objects.

Breaking Changes

`mcp_tools.ts_only` config entry removed; TS MCP tools are now a strict subset of Python ones (0 TS‑only entries).
Total goldenmatch MCP tool count increased from 87 to 90.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track GoldenMatch

Get notified when new releases ship.

About GoldenMatch

All releases →

Related context

Related tools

vector

Earlier breaking changes

v3.1.0 `GOLDENMATCH_FRAME=polars` now requires the `[polars]` extra; raises error without it.
vgoldencheck-v3.0.0 `inferred_type` emits neutral dtype vocabulary (str/int/uint/float/date/datetime/bool/other) instead of raw Polars dtypes.
vgoldencheck-v3.0.0 'inferred_type' now emits a neutral dtype vocabulary instead of raw Polars dtype strings.
vgoldencheck-v3.0.0 `scan_file`, `scan_dataframe`, and CLI `check` now run without Polars, using Arrow-native pyarrow.Table.
v3.0.0 Result frames now return pyarrow.Table instead of Polars DataFrame.