All pull requests

Pull requests

• fix(auth)!: validate token audience by default

  semver-major
  #395·mcollina opened Nov 2, 2026Member·

  ·

• Revert "fix(auth)!: validate token audience by default (#234)"

  #394·mcollina opened Nov 2, 2026Member·

  ·

• chore(deps): update dependency neostandard to ^0.14.0

  #393·renovate[bot] opened Nov 1, 2026Bot·1 task·

  ·

• docs: fix resource URI template example

  #362·aryanbarde80 opened Oct 22, 2026·

  ·
  1

• fix(sse): coherent legacy session subscription lifecycle (#327, #328, #329, #337)

  #358·mcollina opened Oct 19, 2026Member·

  ·
  4

• fix(sse): end the legacy SSE stream at the resolved context's expiresAt

  #357·mcollina opened Oct 19, 2026Member·

  ·

• fix(sse): bound what a legacy SSE stream buffers for a slow reader

  #356·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(tasks): ignore task metadata when tasks are not declared

  #355·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(tasks): do not register a waiter for an already-aborted signal

  #354·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(auth): keep OAuth discovery working under a route prefix

  #353·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix: validate toolArgumentLimits at registration

  #352·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(sse): drop a legacy SSE stream whose client left during setup

  #351·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix: reject messages that are not JSON-RPC 2.0 with -32600

  #350·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(sse): keep hook headers on the legacy SSE GET response

  #349·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(auth): advertise resourceUri from the legacy /mcp metadata route

  #348·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(sse): answer HEAD /mcp with 405 instead of opening a stream

  #347·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(stdio): split input on \n only so a bare \r does not break a message

  #346·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(tasks): fail tasks with a lapsed lease in tasks/list

  #345·mcollina opened Oct 19, 2026Member·

  ·
  1

• fix(tasks): don't share one retention allowance across anonymous callers (#320)

  #326·mcollina opened Oct 17, 2026Member·

  ·
  1

• fix(sse): allocate event ids atomically in the session store (#317)

  #325·mcollina opened Oct 17, 2026Member·

  ·
  1

• fix(jsonrpc): accept batches only for protocol 2025-03-26 (#319)

  #324·mcollina opened Oct 17, 2026Member·

  ·
  1

• fix(jsonrpc): reject request ids that are not a string or safe integer (#318)

  #323·mcollina opened Oct 17, 2026Member·

  ·
  1

• feat: add configurable limits for sessions and resource subscriptions

  #314·mcollina opened Oct 15, 2026Member·

  ·
  1

• fix(security): harden tool argument sanitization against special keys

  #313·mcollina opened Oct 15, 2026Member·

  ·
  1

• feat(tasks)!: reject a taskDefaultTtlMs above taskMaxTtlMs

  semver-major
  #310·mcollina opened Oct 15, 2026Member·

  ·