This release includes 5 security fixes for security teams reviewing exposed deployments.
Topics
Affected surfaces
ReleasePort's take
Moderate signalv0.3.0 hardens Gopher/Gemini handling with multiple security fixes, a breaking config change, and workflow updates.
Why it matters: Security severity scores of 70‑80 trigger mandatory patches; the env‑var prefix shift (severity 70) requires immediate configuration update to avoid runtime failures.
Summary
AI summaryUpdates Version, Commit, and Workflow across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Pin SSRF-validated IP address to prevent re-resolution between validation and connect for Gopher and Gemini. Pin SSRF-validated IP address to prevent re-resolution between validation and connect for Gopher and Gemini. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Security | High |
Add denylist of dangerous service ports as defense-in-depth. Add denylist of dangerous service ports as defense-in-depth. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Security | High |
Close socket on every TLS connection/handshake failure to prevent file‑descriptor leaks. Close socket on every TLS connection/handshake failure to prevent file‑descriptor leaks. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Security | High |
Normalize TOFU trust‑store host keys to reject casing/trailing‑dot variants and fail closed on invalid entries. Normalize TOFU trust‑store host keys to reject casing/trailing‑dot variants and fail closed on invalid entries. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Security | High |
Fail closed on corrupt client‑certificate registry and write trust store files owner‑only. Fail closed on corrupt client‑certificate registry and write trust store files owner‑only. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Breaking | High |
Server settings now read under `GOPHER_MCP_` environment prefix; update any existing env vars accordingly. Server settings now read under `GOPHER_MCP_` environment prefix; update any existing env vars accordingly. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Breaking | Medium |
Reject `--mount-path` for transports that ignore it instead of silently dropping. Reject `--mount-path` for transports that ignore it instead of silently dropping. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Low |
Add range constraints on model port/size fields and classify gemtext links by scheme (relative links are internal). Add range constraints on model port/size fields and classify gemtext links by scheme (relative links are internal). Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Dependency | Medium |
Replace `safety check` with `pip-audit` in CI for dependency scanning and pin PyPI publish action to a commit SHA. Replace `safety check` with `pip-audit` in CI for dependency scanning and pin PyPI publish action to a commit SHA. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Performance | Low |
Move per‑request URL/query logging to DEBUG level. Move per‑request URL/query logging to DEBUG level. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Medium |
Reject explicit invalid or zero ports in Gopher/Gemini URLs instead of coercing to default. Reject explicit invalid or zero ports in Gopher/Gemini URLs instead of coercing to default. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Percent‑decode Gopher selectors to their on‑wire form. Percent‑decode Gopher selectors to their on‑wire form. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Bugfix | Medium |
Parse gemtext using CRLF/LF line endings and preserve preformatted lines verbatim. Parse gemtext using CRLF/LF line endings and preserve preformatted lines verbatim. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Low |
Release client connections on shutdown to prevent leaks. Release client connections on shutdown to prevent leaks. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Bugfix | Low |
Stop double‑wrapping Gemini response parser's validation errors. Stop double‑wrapping Gemini response parser's validation errors. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Refactor | Low |
Fetch tools now return structured error results instead of raising exceptions. Fetch tools now return structured error results instead of raising exceptions. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
Full changelog
Security
- Pin the SSRF-validated IP address for the actual connection so a hostname can
no longer be re-resolved to an internal or rebinding address between the
validation check and the connect (Gopher and Gemini). - Add a denylist of dangerous service ports (SSH, SMTP, Redis, etc.) as
defense-in-depth. - Close the socket on every TLS connection/handshake failure (previously leaked
file descriptors under repeated failures). - Normalize TOFU trust-store host keys so a casing/trailing-dot variant cannot
establish a second pin, and reject a non-valid TOFU result (fail closed). - Fail closed on a corrupt client-certificate registry, and write the trust
store, certificate registry, and private keys owner-only. - Scan dependencies with
pip-auditin CI (replacing the deprecated
safety check) and pin the PyPI publish action to a commit SHA.
Added
- Range constraints on model port/size fields and scheme-based classification of
gemtext links (relative links are internal, not external).
Changed
- Fetch tools now return structured error results instead of raising, so invalid
input, batch limits, and client-setup failures no longer surface as raw tool
errors. - Server settings are read under the
GOPHER_MCP_environment prefix (e.g.
GOPHER_MCP_LOG_LEVEL) so common ambient variables no longer leak into
configuration. Update anyLOG_LEVEL/DEVELOPMENT_MODE/LOG_FILE_PATH
env vars to the prefixed names. --mount-pathis now rejected for transports that ignore it (was silently
dropped for stdio/streamable-http).- Per-request URL/query logging moved to DEBUG.
- Client connections are released on shutdown.
Fixed
- Reject explicit invalid or zero ports in Gopher/Gemini URLs instead of
silently coercing them to the default. - Percent-decode Gopher selectors to their on-wire form.
- Parse gemtext on CRLF/LF only and preserve preformatted lines verbatim.
- Stop double-wrapping the Gemini response parser's own validation errors.
- Enforce the project's full ruff ruleset (it was silently shadowed by a stray
Release Information:
- Version: 0.3.0
- Release Date: 2026-06-08
- Commit: 24b438b
- Workflow: 27109827580
Installation:
pip install gopher-mcp==0.3.0
Verification:
All packages are signed and can be verified using Sigstore.
Security Fixes
- Pin SSRF-validated IP address to prevent re‑resolution between validation and connection in Gopher and Gemini.
- Add denylist of dangerous service ports (SSH, SMTP, Redis, etc.) as defense‑in‑depth.
- Close socket on every TLS handshake failure to avoid file‑descriptor leaks.
- Normalize TOFU trust‑store host keys to reject casing/trailing‑dot variants and fail closed on invalid results.
- Fail closed on corrupt client‑certificate registry; write trust store, registry, and private keys owner‑only.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About cameronrye/gopher-mcp
Modern, cross-platform MCP server enabling AI assistants to browse and interact with both Gopher protocol and Gemini protocol resources safely and efficiently. Features dual protocol support, TLS security, and structured content extraction.
Related context
Related tools
Earlier breaking changes
- v0.5.0 Changes Gemini binary success responses to return only metadata, dropping base64‑inlined bodies.
Beta — feedback welcome: [email protected]