Skip to content

cameronrye/activitypub-mcp

v3.1.5 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Data & Storage
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

activitypub fedify fediverse mcp mcp-server webfinger

Summary

AI summary

Minor fixes and improvements.

Full changelog

[3.1.5] - 2026-06-15

Maintenance release: dependency, toolchain, and CI/security hardening. No runtime
behavior changes — the published server is functionally identical to 3.1.4.

Changed

  • Migrated the build to TypeScript 6 and refreshed the dev/test/build dependency
    groups (vitest, msw, biome, astro, and others via Dependabot).
  • Cleaned up tsconfig.json for TypeScript 6: explicit rootDir, dropped the
    deprecated baseUrl and an unused path alias.

Security

  • Deduplicated esbuild to the patched 0.28.1, clearing two dev-toolchain
    advisories (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr). esbuild is build-time only and
    never shipped, but the dependency tree is now clean.
  • Scoped the blocking CI npm audit gate to production dependencies (what ships in
    dist/), so dev-only docs-site advisories no longer block releases. The strict
    production audit remains required and is clean.

Security Fixes

  • dev-tool: esbuild deduplicated to patched 0.28.1, clearing GHSA-gv7w-rqvm-qjhr and GHSA-g7r4-m6w7-qqqr advisories
  • CI gate now scopes npm audit to production dependencies only
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cameronrye/activitypub-mcp

Get notified when new releases ship.

Sign up free

About cameronrye/activitypub-mcp

A comprehensive MCP server that enables LLMs to explore and interact with the Fediverse through ActivityPub protocol. Features WebFinger discovery, timeline fetching, instance exploration, and cross-platform support for Mastodon, Pleroma, Misskey, and other ActivityPub servers.

All releases →

Related context

Earlier breaking changes

  • v2.1.0 `activitypub://instance-info/{domain}` `software` field now an object instead of a string.
  • v2.1.0 Removed `activitypub://post-thread/{postUrl}` URI form; use `{domain}/{statusId}` instead.
  • v2.0.0 'get-relationship' no longer accepts legacy `accountIds` array; requires single `acct` string.
  • v2.0.0 `MCP_HTTP_CORS_ORIGINS` no longer defaults to '*'; must be set explicitly.
  • v2.0.0 `scheduledId` renamed to `scheduledPostId` in scheduling tools.

Beta — feedback welcome: [email protected]