This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryFixed resources/list handler to reflect runtime changes after boot.
Full changelog
What's Fixed
@vurb/core\
-
esources/list\ handler computed at boot instead of per-request — Registered via IIFE, calculating the list once at \ttachToServer()\ time. Resources added/removed after init were never reflected. Fixed: arrow function called per request. -
Variable shadowing: \signal\ redeclared inside FHP block — \const signal\ inside the handoff block shadowed the outer \signal. Renamed to \handoffSignal.
@vurb/swarm\
- \hasActiveHandoff\ returned \alse\ during \connecting\ phase — Only matched \status === 'active'. During the connecting window, \ServerAttachment\ bypassed \proxyToolsCall\ and routed calls locally. Fixed: _sessions.has(sessionId)\ covers both states.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About vinkius-labs/mcp-fusion
A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.
Related context
Related tools
Beta — feedback welcome: [email protected]