Skip to content

cameronrye/gopher-mcp

v0.5.1 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Browser & Automation
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 5 known CVEs

Topics

gemini gemini-protocol gopher gopher-protocol mcp mcp-server

Affected surfaces

deps

Summary

AI summary

Upgraded runtime dependencies to fix four security advisories (CVE-2026-54283, CVE-2026-54282, GHSA-537c-gmf6-5ccf, GHSA-4xgf-cpjx-pc3j, GHSA-6v7p-g79w-8964).

Full changelog

Security

  • Upgraded runtime dependencies to clear the advisories that pip-audit was
    reporting against the 0.5.0 dependency set:
    • starlette 1.2.1 → 1.3.1 (CVE-2026-54283, CVE-2026-54282)
    • cryptography 48.0.0 → 48.0.1 (GHSA-537c-gmf6-5ccf)
    • pydantic-settings 2.12.0 → 2.14.2 (GHSA-4xgf-cpjx-pc3j)
    • msgpack 1.1.2 → 1.2.1 (GHSA-6v7p-g79w-8964)

Changed

  • Bumped CI workflow actions: actions/checkout 6 → 7 and
    softprops/action-gh-release 3.0.0 → 3.0.1. These affect the release/CI
    pipeline only and do not change the published package.

Release Information:

  • Version: 0.5.1
  • Release Date: 2026-06-22
  • Commit: 88a7d91
  • Workflow: 27958998503

Installation:

pip install gopher-mcp==0.5.1

Verification:
All packages are signed and can be verified using Sigstore.

Security Fixes

  • CVE-2026-54283 — vulnerability in starlette <1.3.1
  • CVE-2026-54282 — vulnerability in starlette <1.3.1
  • GHSA-537c-gmf6-5ccf — vulnerability in cryptography 48.0.0
  • GHSA-4xgf-cpjx-pc3j — vulnerability in pydantic-settings 2.12.0
  • GHSA-6v7p-g79w-8964 — vulnerability in msgpack 1.1.2
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cameronrye/gopher-mcp

Get notified when new releases ship.

Sign up free

About cameronrye/gopher-mcp

Modern, cross-platform MCP server enabling AI assistants to browse and interact with both Gopher protocol and Gemini protocol resources safely and efficiently. Features dual protocol support, TLS security, and structured content extraction.

All releases →

Related context

Earlier breaking changes

  • v0.5.0 Changes Gemini binary success responses to return only metadata, dropping base64‑inlined bodies.
  • v0.3.0 Reject `--mount-path` for transports that ignore it instead of silently dropping.
  • v0.3.0 Server settings now read under `GOPHER_MCP_` environment prefix; update any existing env vars accordingly.

Beta — feedback welcome: [email protected]