fix(container): update image docker.io/samanhappy/mcphub ( 1.0.34 ➔ 1.0.37 ) - #533
Open
renovate[bot] wants to merge 1 commit into
Open
fix(container): update image docker.io/samanhappy/mcphub ( 1.0.34 ➔ 1.0.37 )#533renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
--- kubernetes/apps/ai/mcphub/app Kustomization: ai/mcphub HelmRelease: ai/mcphub
+++ kubernetes/apps/ai/mcphub/app Kustomization: ai/mcphub HelmRelease: ai/mcphub
@@ -49,13 +49,13 @@
PORT: '3000'
READONLY: 'true'
TRUST_PROXY: '1'
USE_DB: 'false'
image:
repository: docker.io/samanhappy/mcphub
- tag: 1.0.34@sha256:9362500c060e98f8b5bc9bfb4b80b2046811d0f4f4c1c2b0c1dab08bc14115bf
+ tag: 1.0.37@sha256:f3ee4b211e288ce74a32e79a898009cc2054392fa2a00aeb9adf26c99d81765e
probes:
liveness:
custom: true
enabled: true
spec:
failureThreshold: 3 |
--- HelmRelease: ai/mcphub Deployment: ai/mcphub
+++ HelmRelease: ai/mcphub Deployment: ai/mcphub
@@ -67,13 +67,13 @@
- name: READONLY
value: 'true'
- name: TRUST_PROXY
value: '1'
- name: USE_DB
value: 'false'
- image: docker.io/samanhappy/mcphub:1.0.34@sha256:9362500c060e98f8b5bc9bfb4b80b2046811d0f4f4c1c2b0c1dab08bc14115bf
+ image: docker.io/samanhappy/mcphub:1.0.37@sha256:f3ee4b211e288ce74a32e79a898009cc2054392fa2a00aeb9adf26c99d81765e
livenessProbe:
failureThreshold: 3
httpGet:
path: /health
port: 3000
periodSeconds: 10 |
renovate
Bot
force-pushed
the
renovate/docker.io-samanhappy-mcphub-1.x
branch
from
September 13, 2026 14:09
d519a86 to
85c0b58
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.0.34→1.0.37Release Notes
samanhappy/mcphub (docker.io/samanhappy/mcphub)
v1.0.37Compare Source
Summary
This release closes a critical security hole: disabling a tool only filtered
tools/list, leaving it executable throughtools/call— so "read-only" connections to Gmail, Microsoft 365, or Nextcloud could be silently bypassed, including via prompt injection. Disabled tools are now enforced at execution time. Login rate limiting counts only failed attempts and is now tunable, so API consumers and service accounts renewing tokens are no longer locked out by successful logins. Group visibility controls arrive withprivate,group, andpublicscopes plus selected-user sharing, enforced across group APIs, MCP/SSE routes, and nested server metadata. Reliability and polish: OAuth clients are cached only after credential persistence succeeds, the Docker quick start is simplified while legacy mounts still work, and console logs render timestamps with the process-local UTC offset.Features
Fixes
摘要
本版本修复了一个严重的安全漏洞：禁用工具此前只会过滤
tools/list，攻击者仍可通过tools/call调用它们——针对 Gmail、Microsoft 365 或 Nextcloud 的「只读」连接因此可能被悄然绕过，包括通过提示注入的方式。现在禁用工具会在执行时真正生效。登录限流改为只统计失败的尝试且阈值可调整，API 调用方与服务账号在令牌续期时不再因成功登录而被误锁。新增分组可见性控制，支持private、group、public三种范围及按选定用户共享，并在分组 API、MCP/SSE 路由与嵌套服务器元数据中全面执行。可靠性与打磨：OAuth 客户端仅在凭据持久化成功后才进入缓存，Docker 快速上手流程得到简化且保留旧挂载，控制台日志按进程本地时区渲染时间戳。功能
修复
New Contributors
References
v1.0.36Compare Source
Summary
This release brings per-user credentials to shared MCP servers: a single shared server definition can now require each caller's own API keys or tokens, managed through the new My Credentials page with bindings encrypted at rest (AES-256-GCM) — so multiple users share one server instead of maintaining duplicate private copies. Reliability is hardened across the board: on-demand servers stay alive while their tools are running, overlapping initialization no longer strands servers in a "connecting" state, transport creation failures are isolated to the affected server, the log-stream reconnect backoff resets correctly, and public auth routes no longer consume the shared
/apirate limiter. Interoperability and polish: OpenAPI query arrays serialize correctly, copied MCP configuration uses group names, single-route tool calls survive session rebuilds, and the js-yaml, hono, and multer dependencies are updated.Features
Fixes
摘要
本版本为共享 MCP 服务器引入了按用户的凭据支持：同一个共享服务器定义现在可以要求每位调用者提供各自的 API 密钥或令牌，通过新增的「我的凭据」（My Credentials）页面管理绑定，并以 AES-256-GCM 加密存储在静态数据中——这样多位用户共享一个服务器，而无需各自维护重复的私有副本。可靠性全面增强：按需启动的服务器在工具运行期间保持存活，重叠初始化不再让服务器卡在「connecting」状态，传输创建失败被隔离到受影响的服务器，日志流重连退避逻辑正确重置，公共认证路由也不再占用共享的
/api限流器。互操作性与细节打磨：OpenAPI 查询数组正确序列化，复制的 MCP 配置使用分组名称，会话重建后单路由工具调用得以保留，并更新了 js-yaml、hono、multer 依赖。功能
修复
New Contributors
References
v1.0.35Compare Source
Summary
This release hardens MCPHub's reliability and interoperability. Upstream OAuth servers now reconnect cleanly after reauthorization, and on-demand server settings (
startOnDemand/idleTimeoutMs) are correctly persisted when running in database mode. Multipart file uploads are decoded and validated more robustly, and embedding dimensions are only forwarded to models that support them. Smart-routing configuration has also been modernized to provider-neutral field names with automatic migration of legacy persisted values, while existingOPENAI_*environment aliases keep working.Features
Fixes
摘要
本版本提升了 MCPHub 的可靠性与互操作性。上游 OAuth 服务器在重新授权后现在可以干净地重连；按需启动的服务器设置（
startOnDemand/idleTimeoutMs）在数据库模式下也能被正确持久化。多部分文件上传的解析与校验更加健壮，嵌入向量维度只会转发给支持它们的模型。智能路由配置也已统一为供应商中立的字段命名，并自动迁移历史持久化值，同时保留现有的OPENAI_*环境变量别名。功能
修复
New Contributors
References
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.