This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+7 more
Affected surfaces
Summary
AI summaryRelay‑first startup always shows the relay URL.
Full changelog
v1.9.0 (2026-03-30)
Bug Fixes
-
Credential resolution order -- relay only when no local credentials (
fcfda4c) -
Pin Docker base images to SHA digests (
b40513b) -
Pin pre-commit hooks to commit SHA (
ac6743b) -
Send complete message to relay page after config saved (
19b2b97) -
cd: Remove empty env blocks from OIDC migration (
d6312ce) -
cd: Replace GH_PAT with GitHub App installation token (
46c2012) -
cd: Use npm OIDC provenance instead of NPM_TOKEN (
50ceb6e) -
ci: Consolidate SMTP_USERNAME and NOTIFY_EMAIL into one secret (
f914d04) -
ci: Consolidate SMTP_USERNAME+PASSWORD into SMTP_CREDENTIAL (
5b125a7) -
ci: Remove CODECOV_TOKEN, use tokenless upload (
f445b0a) -
ci: Use Vertex AI WIF instead of GEMINI_API_KEY for code review (
f6ac417) -
security: Prevent type-stripping in wrapToolResult wrapper (#324,
c99c19b)
Chores
-
deps: Lock file maintenance (
fa9a225) -
deps: Update actions/create-github-app-token action to v3 (#335,
0c499d6) -
deps: Update codecov/codecov-action action to v6 (#330,
7ec6b81) -
deps: Update google-github-actions/auth action to v3 (#336,
738f339)
Code Style
- Fix Biome formatting in plugin/extension JSON files (
82e3134)
Features
- Relay-first startup — always show relay URL (
963488a)
Performance Improvements
Refactoring
- Remove relay setup -- project_path provided per tool call (
c25015e)
Detailed Changes: v1.8.0...v1.9.0
Security Fixes
- Prevent type‑stripping in wrapToolResult wrapper (addresses a security vulnerability)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About n24q02m/better-godot-mcp
18 composite tools for structured Godot 4.x interaction: scenes, nodes, GDScript, shaders, animation, tilemap, physics, audio, navigation, UI, input mapping, and signals.
Related context
Beta — feedback welcome: [email protected]