vinkius-labs/mcp-fusion

v4.0.4 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 8d MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

rce_ssrf deps

Summary

AI summary

Sanitizer now correctly handles process.env in both code and string contexts, preventing deploy rejections.

Changes in this release

Type	Severity	Summary	CVE
Dependency	Low	All @mcpfusion/* cross-dependencies updated to ^4.0.4. All @mcpfusion/* cross-dependencies updated to ^4.0.4. Source: llm_adapter@2026-05-26 Confidence: high	—
Bugfix	Medium	Sanitizer now replaces process.env in code and strings to prevent deploy rejections. Sanitizer now replaces process.env in code and strings to prevent deploy rejections. Source: llm_adapter@2026-05-26 Confidence: high	—

Full changelog

Fixed

Bundles containing process.env inside string literals were rejected by the server-side security scanner. The v4.0.3 context-aware sanitizer correctly preserved process.env inside strings to avoid JS corruption, but the server-side EdgeDeployService static analysis rejects bundles matching /\bprocess\s*\.\s*env\b/ anywhere — including string contexts. Bundles with validation messages like 'Implementation uses process.env directly' passed CLI sanitization but were rejected at deploy time.

Fix: The sanitizer now replaces process.env in ALL contexts: code → process['env'] (bracket notation); strings → process\u002Eenv (Unicode dot escape). Both CLI and runtime sanitizers are aligned.

Changed

All @mcpfusion/* cross-dependencies updated to ^4.0.4

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.0 All packages now published under the `@mcpfusion` npm scope.
v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.