vinkius-labs/mcp-fusion

v3.12.1 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 2mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

auth

Summary

AI summary

Fixed false-positive security scan failures when using requireCredential() or edge bridge APIs.

Full changelog

Fixed

`@vurb/core` — Edge Deploy Bundle Sanitizer

Framework-internal patterns no longer trigger server-side security scan — sanitizeBundleForEdge() now transforms four additional patterns that are legitimately emitted by @vurb/core internals when bundled inline via esbuild. Previously, deploying any server that used requireCredential() or edge bridge APIs would fail with bundle rejected by security scan:
- __vinkius_secrets → Unicode escape breaks the /__vinkius_secrets/ regex while remaining a valid JS identifier at V8 runtime
- process.env → bracket notation (process["env"]) breaks the regex
- __vinkius_edge_ → Unicode escape breaks the /__vinkius_edge_/ regex
- globalThis[ → wrapped access ((globalThis)/**/[) breaks the /globalThis\s*\[/ regex

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.0 All packages now published under the `@mcpfusion` npm scope.
v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.