upstash/context7

[email protected] scope: ctx7 Feature

This release adds 4 notable features for engineering teams evaluating rollout.

Published 1mo MCP Developer Tools

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

llm mcp mcp-server vibe-coding

Affected surfaces

auth breaking_upgrade

Summary

AI summary

CLI files now stored in XDG base directories with automatic migration from ~/.context7.

Type	Severity	Summary	CVE
Dependency	Low	Bump runtime dependencies: commander 13 -> 15, ora 9.0 -> 9.4. Bump runtime dependencies: commander 13 -> 15, ora 9.0 -> 9.4. Source: llm_adapter@2026-06-11 Confidence: high	—
Bugfix	Medium	Recover Context7 library IDs mangled by Git Bash on Windows. Recover Context7 library IDs mangled by Git Bash on Windows. Source: llm_adapter@2026-06-11 Confidence: high	—
Refactor	Low	Store CLI files in XDG Base Directory locations instead of `~/.context7`. Store CLI files in XDG Base Directory locations instead of `~/.context7`. Source: llm_adapter@2026-06-11 Confidence: high	—

Full changelog

cb6aee1: Bump runtime dependencies: commander 13 -> 15 and ora 9.0 -> 9.4.
428af3e: Recover Context7 library IDs that Git Bash mangles on Windows. Git Bash rewrites a leading-slash argument like /facebook/react into a Windows path under the Git install dir (C:/Program Files/Git/facebook/react), causing ctx7 docs to reject it as invalid; this mainly affected users running ctx7 through Claude Code. The CLI now detects and undoes the conversion before validation, accepts the //owner/repo escape, and points users at that workaround for install layouts it can't auto-detect.
c03bc9c: Store CLI files in XDG Base Directory locations instead of ~/.context7. Credentials move to $XDG_CONFIG_HOME/context7 (default ~/.config/context7), updater state to $XDG_STATE_HOME/context7 (default ~/.local/state/context7), and generate previews to $XDG_CACHE_HOME/context7 (default ~/.cache/context7). Existing files in ~/.context7 are migrated automatically on first use; migration is best-effort and falls back to reading the legacy file if it cannot complete. The credentials file is always re-asserted to 0o600 after migration or write so it is never group/world-readable. Relative or empty XDG_* values are ignored per the spec.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track upstash/context7

Get notified when new releases ship.

About upstash/context7

Up-to-date code documentation for LLMs and AI code editors.

[email protected] Removes `--device` flag and localhost-callback path for `ctx7 login`.