s-b-e-n-s-o-n/portkey-admin-mcp

Maintenance release: dependency security patches, a Docker base-image CVE fix, and CI/repo hardening. Two breaking changes: the minimum Node.js version rises to 24, and page_size caps tighten on three list tools (callers passing values above 100 are now rejected at input validation). No other Portkey Admin API surface changes.

Security

• Update transitive hono to 4.12.27, closing five published advisories including GHSA-88fw-hqm2-52qc (CORS credential-reflection, CVSS 7.1). Bump tsx to 4.22.5 so its nested esbuild clears GHSA-g7r4-m6w7-qqqr. npm audit: 0 vulnerabilities.
• Bump the Docker base image from node:24.12-alpine to node:24.18-alpine, picking up the Node 24.17.0 LTS security release (CVE-2026-48618 TLS wildcard-hostname bypass, CVE-2026-48933 WebCrypto DoS).
• Add .dockerignore so .env, .git, and local credentials never enter the Docker build context.
• Harden CI: workflow-level least-privilege permissions block, the optional staging secret scoped to the single smoke step that uses it, and actions/checkout/actions/setup-node pinned to release commit SHAs (checkout moves v6 → v7).
• Harden the release pipeline to zizmor-clean: job-scoped permissions replace the workflow-level contents: write, checkouts stop persisting git credentials where jobs run dependency scripts, npm caching is off in the publish jobs, and the CI gate receives its one secret explicitly instead of secrets: inherit. CI gains an actionlint workflow-lint job, PR dependency review, and per-branch concurrency; CodeQL default setup is enabled on the repo.

Added

• LobeHub marketplace support: lhm.plugin.json manifest, a publish:lobehub npm script, and a documented publish flow in docs/RELEASE.md; the README badge switched to the themed mcp-full LobeHub badge.
• Prerelease versions (any - tag, e.g. 0.5.0-rc.1) now publish to the rc npm dist-tag instead of latest.

Changed

• Minimum Node.js version is now 24 (engines.node: ">=24"). Node 20 reached end of life on 2026-04-30; the build target, CI, and the Docker image already ran Node 24.
• Breaking: cap page_size at 100 on list_workspaces and get_user_stats, and align list_guardrails down from 1000 to 100, matching every other list tool. Requests with larger values are rejected by input validation instead of forwarded.
• Correct the update_config description — all routing/cache/retry fields are editable, not just name/status — and point update_integration at its update_integration_models/update_integration_workspaces siblings.
• Adopt the shared CodesWhat Renovate preset for dependency automation; refresh all in-range dependencies (helmet 8.2.0, jose 6.2.3, zod 4.4.3, typescript 6.0.3, biome 2.5.2 with config migration, knip 6.24.0, esbuild 0.28.1).
• README: animated 3D header icon; drop the typing-SVG banner.

Fixed

• README's Docker HTTP example never set MCP_TRANSPORT=http, so as documented it silently started the stdio server instead of the HTTP server it was configuring.
• Repair npm run test:http (scripts/test-mcp-http.sh): send the required MCP-Protocol-Version header after initialize, default to localhost (default host validation rejects 127.0.0.1), and stop false-positiving on the error property inside tool outputSchemas.

Full Changelog: https://github.com/CodesWhat/portkey-admin-mcp/compare/v0.3.8...v0.4.0