This release keeps dependencies and maintenance posture current for teams operating this tool.
✓ No known CVEs patched in this version
Topics
+14 more
Summary
AI summaryMinor fixes and improvements.
Full changelog
Quality Pass on v0.4.0
No new features — everything here is a drift-correction, polish, or CI fix. Ships green across CI, Evals, Docker, CodeQL, and Sync mirrors.
Fixed
- CI smoke test green. The
transparent logosmoke check was pinned to the pre-0.4.0 transparency-safe whitelist (recraft-v3,gpt-image-1,ideogram-3-turbo) and failed oncerecraft-v4was promoted to primary. The whitelist now includesrecraft-v4andgpt-image-1.5, matching the live routing table. - CI
sharppin aligned..github/workflows/ci.ymlinstalledsharp@^0.33.5on every runner, overriding the^0.34.5declared inpackages/mcp-server/package.json. CI now installs the same major as the package manifest. - Cost guard model IDs synced to the registry. Eight IDs in
cost-guard.tsno longer matcheddata/model-registry.json(hf-sd-xl,hf-sd-3,sdxl-1.0,sd-3-large,leonardo-phoenix-1.0,recraft-v3-svg,flux-pro-1.1,cf-flux-schnell), so cost checks silently fell through. All IDs realigned, andrecraft-v4,gpt-image-1-mini,cf-flux-2-*, and the fullreplicate-*/comfyui-*set are now priced. - Routing-table never-lists no longer reference unregistered models. Dropped
gemini-3-pro-image-preview,nano-banana,nano-banana-pro, andany_diffusion_for_the_text; concretegemini-3-*IDs in the registry already cover the intent.p2a doctor --datanow reports zero never-list warnings. - Typo in og-image fallback chain.
hero_model: "cf-flux-schnell"corrected tocf-flux-1-schnell(the ID that actually exists in the registry). - MCP server version now reads from package.json. The handshake string was hard-coded at
0.3.0even after the package published0.4.0.createServer()now loads the current version frompackage.jsonat runtime.
Changed
data/routing-table.jsonbumped to 1.2.1 / 2026-04-22 to reflect the never-list cleanup.- Cost guard now covers 40+ models including every free-tier and Replicate route, so
P2A_MAX_SPEND_USD_PER_RUNis meaningful on more paths.
Verification
npm run typecheck— passnpm run lint— passnpm run format:check— passnpm run test:run— 241 passed, 2 skippednpm run smoke— passnode packages/mcp-server/dist/index.js doctor --data— zero warningsnode evals/scripts/run.mjs --check— 9/9, no regressionbash scripts/verify-repo.sh— pass
Full changelog: https://github.com/MohamedAbdallah-14/prompt-to-asset/blob/main/CHANGELOG.md
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MohamedAbdallah-14/prompt-to-asset
Generates app icons, favicons, OG images, logos, and wordmarks. Routes each request across 30+ image models. Runs without an API key via Cloudflare Workers AI, NVIDIA NIM, HuggingFace, or Stable Horde. Three modes: inline SVG, external prompt-only, or full API. Validates contrast, OCR text accuracy, and palette before returning.
Related context
Beta — feedback welcome: [email protected]