Skip to content

n24q02m/wet-mcp

v2.25.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Search & Web
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

ai-agents ai-coding claude claude-code crawl4ai cursor
+8 more
docker mcp mcp-server model-context-protocol python searxng web-scraping web-search

Affected surfaces

deps

Summary

AI summary

Patch langchain-core CVE-2026-40087 and cryptography CVE-2026-39892.

Full changelog

v2.25.0 (2026-04-13)

This release is published under the MIT License.

Bug Fixes

  • Add composite index to accelerate RAG prefetching (8b237d6)

  • Add debug logging for GDrive callback and remove auto-open browser (297ec46)

  • Add tests for chunk_llms_txt in docs (#826, b3abebb)

  • Add tests for chunk_markdown in docs (#829, 0ec6d95)

  • Add tests for get_model_capabilities in llm (#836, 2441119)

  • Add tests for token management in token_store (#827, bf9ed1a)

  • Apply ruff format to db.py and test_docs_coverage.py (c7172a8)

  • Auto-open default browser at Google device-code URL (6f6c539)

  • Bump n24q02m-mcp-core to >=1.0.0 stable (15ed8ce)

  • Clean up debug logging for GDrive callback (c2b67ef)

  • Correct README setup tool actions and config tool description (d265506)

  • Correct relay schema capability info for search and extraction (c552daa)

  • Cover _gdrive_token_poll and credential_state edge paths (dad75ec)

  • Cover try_open_browser paths + drop local uv.sources override (36d2479)

  • Do not auto-open browser from background sync loop (ee48db9)

  • Ensure chunk_llms_txt test content forces multi-chunk split (2b4b80c)

  • Linting issues in tests/test_setup_tool_logging.py (#778, 9982527)

  • MacOS CI test failures (hardcoded /tmp + sqlite-vec extension) (f43d400)

  • N+1 query in document prefetching via row-value IN (e51b17e)

  • Patch langchain-core CVE-2026-40087 and cryptography CVE-2026-39892 (b3a80a6)

  • Remove unused _AUDIO_OUTPUT_MODELS import (b994e23)

  • Retry GDrive folder search before creating to prevent duplicates (a034bfb)

  • Revert GDrive scope to drive.file (drive.appdata incompatible with device code flow) (134c028)

  • Simplify run_http to use run_local_server with setup_complete_hook (7093cb9)

  • Sync local changes from workspace (3329320)

  • Tighten _is_unsupported_param pattern and document reranker sync gap (9c721db)

  • Unblock main branch CI (lint+type+test cascade from async embedder migration) (811e9d1)

  • Update docker/build-push-action digest to bcafcac (8b70385)

  • Update non-major dependencies (f823d95)

  • Update python:3.13-slim-bookworm docker digest to 061b6e5 (f790a1e)

  • Use re.finditer with early break in chunk quality score (61bead5)

Chores

  • Acknowledge PR closure and finalize cleanup task (#776, b3a1133)

  • Acknowledge PR closure and stop work (#775, 1cc7b78)

  • Add logging to broad exception catches in credential_state.py (#776, b3a1133)

  • Final state after PR closure acknowledgement (#778, 9982527)

Features

  • Add cross-OS CI matrix (ubuntu/windows/macos) (d1acd98)

  • Add GDrive device code flow to local OAuth and fix Jina helpText (6d591d9)

  • Add HTTP transport with local OAuth AS, replace stdio default (e9b9bed)

  • Add HTTP+OAuth E2E test to unified test file (e397970)

  • Migrate from mcp-relay-core to mcp-core (2efc8d0)

  • Migrate GDrive sync from drive.file to drive.appdata scope (1e25f17)

  • Wire GDrive completion callback to form status polling (eb4980e)

Performance Improvements

  • Finalize async embedding backend conversion (#775, 1cc7b78)

  • Optimize dictionary scoring union in db.py (#815, 2138166)

  • Replace blocking time.sleep with asyncio.sleep in embedder (#775, 1cc7b78)

Refactoring

  • Improve visibility of broad exception catches in credential_state.py (#776, b3a1133)

  • Log broad exceptions in _validate_cloud_models (#778, 9982527)

  • Log broad exceptions in _validate_cloud_models (ready for review) (#778, 9982527)

  • server: Narrow exception handling and add logging in tool JSON formatting (#812, cfb9799)

  • server: Narrow exception handling in media.analyze (#812, cfb9799)


Detailed Changes: v2.24.0...v2.25.0

Security Fixes

  • Patch langchain-core CVE-2026-40087 and cryptography CVE-2026-39892
  • CVE-2026-39892

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track n24q02m/wet-mcp

Get notified when new releases ship.

Sign up free

About n24q02m/wet-mcp

Web search (embedded SearXNG), content extraction, and library docs indexing with hybrid search (FTS5 + semantic). Built-in Qwen3 embedding, no API keys required.

All releases →

Beta — feedback welcome: [email protected]