This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryFixed a race condition corrupting session data in the serverless FSM.
Full changelog
Fixed
-
FSM race condition in serverless — Concurrent requests shared mutable FSM state, corrupting session data. Added
StateMachineGate.clone()for per-request isolation whenfsmStoreis present. -
Underscore parsing breaks Inspector topology —
startServer.tssplit flat tool names by'_', misattributing groups for tools likeuser_accounts_list. Now usesbuilder.getName()directly. -
Same underscore bug in telemetry —
ServerAttachment.tsusedsplit('_')for route events, producing incorrect telemetry attribution. Now resolves via exposition routing map. -
** createGroup.execute() throws instead of returning ToolResponse** — Unknown actions threw
Errorand Zod validation threwZodError, violating thePromise<ToolResponse>contract. Now returnstoolError()withINVALID_PARAMScode. -
schema.strict() re-allocated per call — Strict schemas now pre-computed at group creation time.
Test Suite
- 55 new regression tests across 6 test files covering FSM concurrency isolation, underscore parsing correctness, and createGroup contract compliance.
- 3340 total tests passing across 128 test files.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About vinkius-labs/mcp-fusion
A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.
Related context
Related tools
Beta — feedback welcome: [email protected]