This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryProxyHandler now throws a descriptive error when a URL path parameter is missing.
Full changelog
What's Changed
Refactoring
-
\defineModel\ — shared \ieldTypeToZod\ compiler — Extracted a private \ieldTypeToZod(def, childCompiler)\ helper and \labelFor(def)\ util to eliminate ~50 lines of duplicated \switch/case\ logic between \compileField\ and \compileFieldForInput. Both functions now delegate to a shared base, making type mappings a single source of truth.
-
\FluentToolBuilder\ — \withDesc()\ schema helper — Introduced a module-level \withDesc(schema, description?)\ helper that applies .describe()\ only when a description is provided. Replaced the repeated ternary across all 20+ \with*()\ and \withOptional*()\ methods. Bulk array methods also create the base schema once outside the loop.
-
\EgressGuard\ — type-safe \uildTruncationSuffix()\ function — Replaced the implicit {limit}\ placeholder string with a typed function that takes \ormattedLimit\ as a required argument, making the contract explicit and eliminating a class of silent template errors.
Bug Fixes
-
\ProxyHandler\ — HTTP dispatch table + missing path-param guard — Replaced \switch/case\ with a typed \HTTP_DISPATCH\ lookup object. Added an early guard for missing URL path parameters — previously a missing :param\ value was silently coerced to an empty string; now throws a descriptive error.
-
\ConcurrencyGuard\ — remove unsafe
eadonly\ cast — \PendingWaiter.resolve\ was declared
eadonly\ but abort-listener cleanup mutated it via an illegal type assertion. Changed to mutable and removed the unsafe cast. -
\MutationSerializer\ — cooperative abort during queue wait — Previously checked \signal.aborted\ only after \wait prev\ resolved. Now uses \Promise.race([prev, abortPromise])\ so cancellation fires immediately during mutex wait. Abort event listener is cleaned up on normal resolution to prevent memory leaks.
Packages
All 13 packages bumped to \3.7.10: @vurb/core, @vurb/api-key, @vurb/aws, @vurb/cloudflare, @vurb/inspector, @vurb/jwt, @vurb/n8n, @vurb/oauth, @vurb/openapi-gen, @vurb/prisma-gen, @vurb/skills, @vurb/testing, @vurb/vercel.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About vinkius-labs/mcp-fusion
A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.
Related context
Related tools
Beta — feedback welcome: [email protected]