This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
Summary
AI summaryOpenAI Apps domain verification added via hosted MCP and Cloud Run playbook.
Full changelog
Added
- OpenAI Apps domain verification for hosted MCP. HTTP mode now serves the raw
OPENAI_APPS_CHALLENGE_TOKENfrom/.well-known/openai-apps-challenge, allowing
ChatGPT Apps domain verification against Cloud Run and other HTTPS-hosted MCP origins without
committing the token. - Cloud Run verification playbook.
deploy/cloud-rundocuments the Challenge Base URL shape,
token environment variable, andcurlcheck for ChatGPT Apps verification, and the wrapper now
tracks thesemiotic@^3.7.3release line.
Tests
- Added MCP HTTP regression coverage for the OpenAI Apps challenge route while confirming the
unauthenticated OAuth protected-resource probe continues to return 404.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About nteract/semiotic
React data visualization MCP server with 30+ chart types. 5 tools: suggest charts for a dataset, render validated React configs to SVG, diagnose configuration anti-patterns, get component schemas, and report issues.
Related context
Related tools
Earlier breaking changes
- v3.8.1 Removed `/healthz` alias; only `GET /health` is supported for health checks.
- v3.8.0 Deprecates `GuantletChart` typo alias; use `GauntletChart`. Migration required.
- v3.6.0 Changes DifferenceChart to accept 2+ series via top‑2 subselection, adding caveats for extra series.
- v3.6.0 Changes AreaChart to a single‑series chart; multi‑series inputs are subselected.
Beta — feedback welcome: [email protected]