Skip to content

vinkius-labs/mcp-fusion

v3.7.10 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 2mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

auth rbac

Summary

AI summary

ProxyHandler now throws a descriptive error when a URL path parameter is missing.

Full changelog

What's Changed

Refactoring

  • \defineModel\ — shared \ ieldTypeToZod\ compiler — Extracted a private \ ieldTypeToZod(def, childCompiler)\ helper and \labelFor(def)\ util to eliminate ~50 lines of duplicated \switch/case\ logic between \compileField\ and \compileFieldForInput. Both functions now delegate to a shared base, making type mappings a single source of truth.

  • \FluentToolBuilder\ — \withDesc()\ schema helper — Introduced a module-level \withDesc(schema, description?)\ helper that applies .describe()\ only when a description is provided. Replaced the repeated ternary across all 20+ \with*()\ and \withOptional*()\ methods. Bulk array methods also create the base schema once outside the loop.

  • \EgressGuard\ — type-safe \uildTruncationSuffix()\ function — Replaced the implicit {limit}\ placeholder string with a typed function that takes \ ormattedLimit\ as a required argument, making the contract explicit and eliminating a class of silent template errors.

Bug Fixes

  • \ProxyHandler\ — HTTP dispatch table + missing path-param guard — Replaced \switch/case\ with a typed \HTTP_DISPATCH\ lookup object. Added an early guard for missing URL path parameters — previously a missing :param\ value was silently coerced to an empty string; now throws a descriptive error.

  • \ConcurrencyGuard\ — remove unsafe
    eadonly\ cast
    — \PendingWaiter.resolve\ was declared
    eadonly\ but abort-listener cleanup mutated it via an illegal type assertion. Changed to mutable and removed the unsafe cast.

  • \MutationSerializer\ — cooperative abort during queue wait — Previously checked \signal.aborted\ only after \wait prev\ resolved. Now uses \Promise.race([prev, abortPromise])\ so cancellation fires immediately during mutex wait. Abort event listener is cleaned up on normal resolution to prevent memory leaks.

Packages

All 13 packages bumped to \3.7.10: @vurb/core, @vurb/api-key, @vurb/aws, @vurb/cloudflare, @vurb/inspector, @vurb/jwt, @vurb/n8n, @vurb/oauth, @vurb/openapi-gen, @vurb/prisma-gen, @vurb/skills, @vurb/testing, @vurb/vercel.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

Sign up free

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Earlier breaking changes

  • v4.0.0 All packages now published under the `@mcpfusion` npm scope.
  • v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
  • v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.

Beta — feedback welcome: [email protected]