This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+8 more
Affected surfaces
Summary
AI summaryPatch langchain-core CVE-2026-40087 and cryptography CVE-2026-39892.
Full changelog
v2.25.0 (2026-04-13)
This release is published under the MIT License.
Bug Fixes
-
Add composite index to accelerate RAG prefetching (
8b237d6) -
Add debug logging for GDrive callback and remove auto-open browser (
297ec46) -
Add tests for token management in token_store (#827,
bf9ed1a) -
Apply ruff format to db.py and test_docs_coverage.py (
c7172a8) -
Auto-open default browser at Google device-code URL (
6f6c539) -
Bump n24q02m-mcp-core to >=1.0.0 stable (
15ed8ce) -
Clean up debug logging for GDrive callback (
c2b67ef) -
Correct README setup tool actions and config tool description (
d265506) -
Correct relay schema capability info for search and extraction (
c552daa) -
Cover _gdrive_token_poll and credential_state edge paths (
dad75ec) -
Cover try_open_browser paths + drop local uv.sources override (
36d2479) -
Do not auto-open browser from background sync loop (
ee48db9) -
Ensure chunk_llms_txt test content forces multi-chunk split (
2b4b80c) -
Linting issues in tests/test_setup_tool_logging.py (#778,
9982527) -
MacOS CI test failures (hardcoded /tmp + sqlite-vec extension) (
f43d400) -
N+1 query in document prefetching via row-value IN (
e51b17e) -
Patch langchain-core CVE-2026-40087 and cryptography CVE-2026-39892 (
b3a80a6) -
Remove unused _AUDIO_OUTPUT_MODELS import (
b994e23) -
Retry GDrive folder search before creating to prevent duplicates (
a034bfb) -
Revert GDrive scope to drive.file (drive.appdata incompatible with device code flow) (
134c028) -
Simplify run_http to use run_local_server with setup_complete_hook (
7093cb9) -
Sync local changes from workspace (
3329320) -
Tighten _is_unsupported_param pattern and document reranker sync gap (
9c721db) -
Unblock main branch CI (lint+type+test cascade from async embedder migration) (
811e9d1) -
Update docker/build-push-action digest to bcafcac (
8b70385) -
Update non-major dependencies (
f823d95) -
Update python:3.13-slim-bookworm docker digest to 061b6e5 (
f790a1e) -
Use re.finditer with early break in chunk quality score (
61bead5)
Chores
-
Acknowledge PR closure and finalize cleanup task (#776,
b3a1133) -
Add logging to broad exception catches in credential_state.py (#776,
b3a1133) -
Final state after PR closure acknowledgement (#778,
9982527)
Features
-
Add cross-OS CI matrix (ubuntu/windows/macos) (
d1acd98) -
Add GDrive device code flow to local OAuth and fix Jina helpText (
6d591d9) -
Add HTTP transport with local OAuth AS, replace stdio default (
e9b9bed) -
Add HTTP+OAuth E2E test to unified test file (
e397970) -
Migrate from mcp-relay-core to mcp-core (
2efc8d0) -
Migrate GDrive sync from drive.file to drive.appdata scope (
1e25f17) -
Wire GDrive completion callback to form status polling (
eb4980e)
Performance Improvements
Refactoring
-
Improve visibility of broad exception catches in credential_state.py (#776,
b3a1133) -
Log broad exceptions in _validate_cloud_models (#778,
9982527) -
Log broad exceptions in _validate_cloud_models (ready for review) (#778,
9982527) -
server: Narrow exception handling and add logging in tool JSON formatting (#812,
cfb9799) -
server: Narrow exception handling in media.analyze (#812,
cfb9799)
Detailed Changes: v2.24.0...v2.25.0
Security Fixes
- Patch langchain-core CVE-2026-40087 and cryptography CVE-2026-39892
- CVE-2026-39892
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About n24q02m/wet-mcp
Web search (embedded SearXNG), content extraction, and library docs indexing with hybrid search (FTS5 + semantic). Built-in Qwen3 embedding, no API keys required.
Related context
Beta — feedback welcome: [email protected]