hydrolix/mcp-hydrolix

v0.3.4 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 17d MCP Data & Storage

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Affected surfaces

deps

Summary

AI summary

Bumped urllib3, python-multipart, and pyjwt to clear high‑severity CVEs.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Low	Add `HYDROLIX_HTTP_QUERY_PATH` env var to set ClickHouse query endpoint path (default /query). Add `HYDROLIX_HTTP_QUERY_PATH` env var to set ClickHouse query endpoint path (default /query). Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Add `HYDROLIX_QUERY_HEAD_POOL` env var to route to a named query‑head pool via CHProxy, overriding `HYDROLIX_DATABASE`. Add `HYDROLIX_QUERY_HEAD_POOL` env var to route to a named query‑head pool via CHProxy, overriding `HYDROLIX_DATABASE`. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Add outbound HTTP(S) proxy support via `HYDROLIX_HTTP_PROXY` and `HYDROLIX_HTTPS_PROXY`. Add outbound HTTP(S) proxy support via `HYDROLIX_HTTP_PROXY` and `HYDROLIX_HTTPS_PROXY`. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Make `execute_query` SETTINGS configurable via env vars: HYDROLIX_QUERY_MAX_MEMORY_USAGE, HYDROLIX_QUERY_MAX_RESULT_ROWS, HYDROLIX_QUERY_MAX_ATTEMPTS, HYDROLIX_QUERY_TIMERANGE_REQUIRED, HYDROLIX_MAX_RAW_TIMERANGE, HYDROLIX_MAX_RESULT_CELLS, HYDROLIX_CONNECT_TIMEOUT, HYDROLIX_SEND_RECEIVE_TIMEOUT. Make `execute_query` SETTINGS configurable via env vars: HYDROLIX_QUERY_MAX_MEMORY_USAGE, HYDROLIX_QUERY_MAX_RESULT_ROWS, HYDROLIX_QUERY_MAX_ATTEMPTS, HYDROLIX_QUERY_TIMERANGE_REQUIRED, HYDROLIX_MAX_RAW_TIMERANGE, HYDROLIX_MAX_RESULT_CELLS, HYDROLIX_CONNECT_TIMEOUT, HYDROLIX_SEND_RECEIVE_TIMEOUT. Source: llm_adapter@2026-07-16 Confidence: high	—
Dependency	Critical	Bump urllib3 2.6.3 → 2.7.0, python-multipart 0.0.27 → 0.0.32, pyjwt 2.12.1 → 2.13.0 to clear high-severity CVEs (CVE-2026-44432, CVE-2026-53539, CVE-2026-48526). Bump urllib3 2.6.3 → 2.7.0, python-multipart 0.0.27 → 0.0.32, pyjwt 2.12.1 → 2.13.0 to clear high-severity CVEs (CVE-2026-44432, CVE-2026-53539, CVE-2026-48526). Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

v0.3.4

Added

HYDROLIX_HTTP_QUERY_PATH (default /query) sets the HTTP request path for the ClickHouse query endpoint, for clusters that serve queries on a non-root path. (#133, HDX-11831)
HYDROLIX_QUERY_HEAD_POOL routes to a named query-head pool via connection-time database routing (CHProxy); wins over HYDROLIX_DATABASE when both are set. (#132, HDX-11822)
Outbound HTTP(S) proxy support for the Hydrolix connection via HYDROLIX_HTTP_PROXY / HYDROLIX_HTTPS_PROXY, so a server behind a mandatory proxy can reach the cluster. (#130, HDX-11784)
execute_query SETTINGS now configurable via env vars: HYDROLIX_QUERY_MAX_MEMORY_USAGE, HYDROLIX_QUERY_MAX_RESULT_ROWS, HYDROLIX_QUERY_MAX_ATTEMPTS, HYDROLIX_QUERY_TIMERANGE_REQUIRED, HYDROLIX_MAX_RAW_TIMERANGE, HYDROLIX_MAX_RESULT_CELLS, HYDROLIX_CONNECT_TIMEOUT, HYDROLIX_SEND_RECEIVE_TIMEOUT. (#127)

Changed

Bump urllib3 2.6.3 → 2.7.0, python-multipart 0.0.27 → 0.0.32, and pyjwt 2.12.1 → 2.13.0 to clear high-severity CVEs (CVE-2026-44432, CVE-2026-53539, CVE-2026-48526) and associated medium/low CVEs. (#131)

Full Changelog: https://github.com/hydrolix/mcp-hydrolix/compare/v0.3.3...v0.3.4

Security Fixes

CVE-2026-44432 – high severity in urllib3 2.7.0
CVE-2026-53539 – high severity in python-multipart 0.0.32
CVE-2026-48526 – high severity in pyjwt 2.13.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track hydrolix/mcp-hydrolix

Get notified when new releases ship.

About hydrolix/mcp-hydrolix

Hydrolix time-series datalake integration providing schema exploration and query capabilities to LLM-based workflows.

All releases →