This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+4 more
Summary
AI summaryFixed crashes caused by unpaired UTF-16 surrogates in Telegram API responses.
Full changelog
Bug fix
Fix: unpaired UTF-16 surrogate crash
Telegram API can return strings containing unpaired UTF-16 surrogates (from certain emoji sequences or exotic character names). These surrogates break JSON.stringify() in the MCP SDK, causing invalid_request_error: no low surrogate in string errors.
Added sanitize() function that replaces lone surrogates with U+FFFD (replacement character) in all tool text responses. This prevents JSON serialization failures when chat names, descriptions, or messages contain problematic Unicode.
Docs
- Added missing tools to README:
telegram-search-global,telegram-get-profile-photo,telegram-get-reactions - Updated
telegram-send-reactionparameters documentation (multi-emoji support,addToExisting) - Updated TypeScript badge to 6.0
Dependencies
- TypeScript 5.9.3 → 6.0.2
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About overpod/mcp-telegram
Telegram MCP server via MTProto/GramJS — 20 tools for reading chats, searching messages, downloading media, managing contacts. QR code login, npx zero-install. Hosted version at mcp-telegram.com.
Related context
Beta — feedback welcome: [email protected]