This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Moderate signalThe stdio MCP server now exits cleanly when the parent process closes its stdio, preventing orphaned node processes from consuming memory. Additionally, hallucinated argument names on tools/call requests are rewritten to canonical names before validation.
Why it matters: Patch immediately if your deployment uses the stdio MCP server to avoid runaway processes; also update to handle corrected tools/call argument handling in version @upstash/[email protected].
Summary
AI summaryFixed stdio MCP server hanging after parent process termination.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Accept hallucinated argument names on tools/call requests by rewriting them to canonical names before validation. Accept hallucinated argument names on tools/call requests by rewriting them to canonical names before validation. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Exit stdio MCP server when parent process closes its stdio, preventing orphaned node processes consuming memory. Exit stdio MCP server when parent process closes its stdio, preventing orphaned node processes consuming memory. Source: llm_adapter@2026-05-21 Confidence: high |
— |
Full changelog
Patch Changes
- 187287c: Accept hallucinated argument names on
tools/callrequests by rewriting them to the canonical names before validation.userQueryandquestionare mapped toqueryon either tool; onquery-docs,context7CompatibleLibraryID,libraryID, andlibraryNameare mapped tolibraryId. Some LLM clients produce these alternative names — likely echoing phrasing from each tool's description — and previously triggeredInvalid input: expected string, received undefinederrors.libraryNameis only rewritten onquery-docscalls because it is the canonical arg forresolve-library-id. Tool input schemas published viatools/listare unchanged: canonical names remain the documented required fields, the rewrite is purely a server-side compatibility shim that runs only ontools/calland only when the canonical key is absent. - 78b9826: Exit the stdio MCP server when the parent process closes its stdio. Previously, if the parent (e.g. Claude Code) was force-killed shortly after a tool call, an idle undici keep-alive socket to the Context7 API would keep libuv's event loop alive past stdin EOF, leaving an orphaned
nodeprocess that consumed memory until the kernel tore the socket down (which on Cloudflare-fronted endpoints can take hours). The server now listens forend/closeon stdin andSIGHUPand exits cleanly. Fixes #2542.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]