Skip to content

imatza-rh/mcp-zuul

v0.3.2 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 2mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Affected surfaces

auth deps

Summary

AI summary

Auth token protection hardens against leakage on cross‑origin redirects.

Full changelog

Security Hardening

  • Auth token protection — _BearerAuth (httpx.Auth subclass) prevents token leakage on cross-origin redirects
  • Streaming size caps — fetch_log_url (20 MB), stream_log (10 MB) prevent unbounded memory consumption
  • Precise stream truncation — includes partial last chunk up to the exact size limit
  • XML safety — defusedxml.ElementTree for JUnit XML parsing
  • Kerberos auth lock — asyncio.Lock serializes concurrent re-auth to prevent session corruption
  • Non-JSON response handling — clear errors when reverse proxies return HTML for all API functions
  • SPNEGO token guard — prevents sending empty Negotiate header

Added

  • Default limit=200 for list_jobs/list_projects
  • asyncio.Semaphore(10) for concurrent buildset detail fetches
  • Single-tenant Zuul URL support in parse_zuul_url
  • Shared _parse_playbooks() and _truncate_invocation() helpers
  • CONTRIBUTING.md, SECURITY.md, CHANGELOG.md, Makefile
  • GitHub issue and PR templates
  • Test coverage gate at 85% (currently 89%)

Full Changelog: https://github.com/imatza-rh/mcp-zuul/compare/v0.3.1...v0.3.2

Security Fixes

  • _BearerAuth (httpx.Auth subclass) prevents token leakage on cross-origin redirects
  • defusedxml.ElementTree used for JUnit XML parsing to mitigate XML attacks
  • asyncio.Lock serializes concurrent Kerberos re‑auth to prevent session corruption
  • SPNEGO guard blocks empty Negotiate header transmission
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track imatza-rh/mcp-zuul

Get notified when new releases ship.

Sign up free

About imatza-rh/mcp-zuul

Zuul CI integration with 14 tools for build failure analysis, log search, pipeline status, and job configuration.

All releases →

Related context

Beta — feedback welcome: [email protected]