From d8835b255a3c633ef99f1b02311529ca2239903f Mon Sep 17 00:00:00 2001 From: mohammed naji Date: Fri, 11 Sep 2026 08:39:01 +0400 Subject: [PATCH] chore(release): prepare v1.1.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Finalize the compatible v1.1.5 patch release. The only change that reaches installers is the @hono/node-server runtime dependency, refreshed from 2.0.10 to 2.1.1. Neither version carries a security advisory, so this is a dependency refresh rather than a security release, and no runtime behavior or public API changed. Also records the [Unreleased] changelog entry for #446, which merged without one. That work — Vitest 5, @types/node 26, esbuild, eslint, typescript-eslint — is development tooling and is not published, though it does clear the two development-only advisories that v1.1.4 explicitly did not claim. Refs #447 Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 7 +++++++ README.md | 2 +- docs/mcp-compatibility.md | 2 +- docs/presets-and-clients.md | 2 +- docs/whats-new-in-0.5.md | 4 ++-- package-lock.json | 4 ++-- package.json | 2 +- tests/release-version.test.ts | 22 +++++++++------------- 8 files changed, 24 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bae123b..64d99df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file. The format ## [Unreleased] +## [1.1.5] - 2026-09-11 + +### Changed + +- [#447](https://github.com/mohanagy/miftah/issues/447) Prepared the compatible v1.1.5 patch release. The only change that reaches installers is the `@hono/node-server` runtime dependency, refreshed from 2.0.10 to 2.1.1; neither version carries a security advisory, so this is a dependency refresh rather than a security release. No runtime behavior and no public API changed. Publication remains gated on exact `development`-to-`main` promotion and protected OIDC trusted publishing, registry provenance, a fresh install, and package-signature verification; this release does not authorize removal of any legacy behavior. +- [#446](https://github.com/mohanagy/miftah/issues/446) Landed the Dependabot backlog and modernized the development toolchain, superseding five pull requests that could not pass on their own: the Vitest pair was split across separate PRs so each broke the other's peer requirement, two bumped packages pinned by the security-override contract tests, and one needed source work. Vitest moved 3.2.7 to 5.0.0 with `@vitest/coverage-v8` and an explicit `vite` peer, alongside `@types/node` 22 to 26, `esbuild` 0.28.1 to 0.28.2, `eslint` 10.8.0 to 10.10.0, and `typescript-eslint` 8.65.0 to 8.70.0. `@types/node` 26 added a `throwIfNoEntry` overload to `stat()`, so `Awaited>` resolves to a union including `undefined` whose `keyof` is `never`; the affected type derivations were replaced with the concrete `Stats` type, which is erased at compile time and changes no runtime behavior. Vitest 4 removed `test.poolOptions` in favour of top-level options, and Vitest 5 applies AST-aware remapping unconditionally, so function and branch coverage figures are not comparable across the migration and were recalibrated to measured actuals with line thresholds unchanged. This toolchain work is not published. It does clear the two development-only advisories that v1.1.4 explicitly did not claim, so both the production-only and full npm audits now report zero for this repository. `zod` was deliberately held at 4.2.0 in the lockfile only, leaving the declared `^4.2.0` range untouched, because the evidence-pinned bundled test fixture embeds `zod` and bumping it would invalidate the recorded fixture hash that the named-host compatibility evidence depends on. + ## [1.1.4] - 2026-09-11 ### Fixed diff --git a/README.md b/README.md index 90c03e5..29f0d42 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ Install Miftah, then choose the terminal wizard or the browser Console. Both use ### 1. Install the current release ```bash -npm install -g @lubab/miftah@1.1.4 +npm install -g @lubab/miftah@1.1.5 miftah version ``` diff --git a/docs/mcp-compatibility.md b/docs/mcp-compatibility.md index 15e9ec5..6d7f7c0 100644 --- a/docs/mcp-compatibility.md +++ b/docs/mcp-compatibility.md @@ -2,7 +2,7 @@ This page is the compatibility source of truth for Miftah's downstream MCP server. It records protocol-era behavior separately from generated client-configuration support and from upstream MCP transport support. A generated snippet proves only that Miftah emitted the documented JSON shape; it does not prove that an untested host completed a protocol exchange. -- Miftah baseline: `1.1.4` +- Miftah baseline: `1.1.5` - Locked MCP TypeScript packages: `@modelcontextprotocol/client`, `core`, `server`, `node`, and `server-legacy` `2.0.0` - Evidence date: 2026-08-23 - Modern protocol era: `2026-07-28` diff --git a/docs/presets-and-clients.md b/docs/presets-and-clients.md index b0362a5..ebba8d7 100644 --- a/docs/presets-and-clients.md +++ b/docs/presets-and-clients.md @@ -5,7 +5,7 @@ This is the compatibility source of truth for generated `miftah init` configurat For downstream protocol eras and real packaged-host evidence, see [MCP protocol and client compatibility](mcp-compatibility.md). The tables below validate generated configuration shapes; they do not by themselves establish a runtime exchange with Claude Desktop, Claude Code, Cursor, or VS Code. - Catalog version: `3` -- Miftah package version: `1.1.4` +- Miftah package version: `1.1.5` - Last tested / validation boundary: the catalog builds strict Miftah configuration that `validateConfig` accepts. The docs contract test checks generated configuration only; it does **not** construct a runtime, start, authenticate to, or smoke-test external providers. Miftah itself requires Node.js `>=20`. That does not establish an upstream server's Node requirement. diff --git a/docs/whats-new-in-0.5.md b/docs/whats-new-in-0.5.md index c162b4f..6385b09 100644 --- a/docs/whats-new-in-0.5.md +++ b/docs/whats-new-in-0.5.md @@ -1,9 +1,9 @@ # What is in Miftah 0.5 -Install `@lubab/miftah@1.1.4`, the current stable release, to use the guided setup and account-management capabilities introduced in 0.5 instead of assembling a multi-account configuration by hand: +Install `@lubab/miftah@1.1.5`, the current stable release, to use the guided setup and account-management capabilities introduced in 0.5 instead of assembling a multi-account configuration by hand: ```bash -npm install -g @lubab/miftah@1.1.4 +npm install -g @lubab/miftah@1.1.5 miftah version ``` diff --git a/package-lock.json b/package-lock.json index f43ae5a..5c9ec00 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@lubab/miftah", - "version": "1.1.4", + "version": "1.1.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@lubab/miftah", - "version": "1.1.4", + "version": "1.1.5", "license": "MIT", "dependencies": { "@hono/node-server": "2.1.1", diff --git a/package.json b/package.json index b8bc700..4c32b8f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@lubab/miftah", - "version": "1.1.4", + "version": "1.1.5", "description": "Wrap any MCP. Use the right account without reconnecting.", "keywords": [ "mcp", diff --git a/tests/release-version.test.ts b/tests/release-version.test.ts index 7b7d627..d72ca83 100644 --- a/tests/release-version.test.ts +++ b/tests/release-version.test.ts @@ -1,7 +1,7 @@ import { readFileSync } from "node:fs"; import { describe, expect, it } from "vitest"; -const releaseVersion = "1.1.4"; +const releaseVersion = "1.1.5"; function readRepositoryFile(path: string): string { return readFileSync(new URL(`../${path}`, import.meta.url), "utf8"); @@ -21,15 +21,15 @@ function releaseNotes(changelog: string, version: string): string { return changelog.slice(match.index, end < 0 ? undefined : end); } -describe("v1.1.4 release artifacts", () => { +describe("v1.1.5 release artifacts", () => { it.each([ { name: "a non-zero-padded date", - changelog: "## [1.1.4] - 2026-9-11\n\n### Changed\n" + changelog: "## [1.1.5] - 2026-9-11\n\n### Changed\n" }, { name: "a heading that does not start its line", - changelog: "Release candidate: ## [1.1.4] - 2026-09-11\n\n### Changed\n" + changelog: "Release candidate: ## [1.1.5] - 2026-09-11\n\n### Changed\n" } ])("rejects $name", ({ changelog }) => { expect(() => releaseNotes(changelog, releaseVersion)).toThrow( @@ -71,20 +71,17 @@ describe("v1.1.4 release artifacts", () => { } }); - it("documents the v1.1.4 dialect fix and its dependency remediation", () => { + it("documents the v1.1.5 dependency refresh and its published boundary", () => { const changelog = readRepositoryFile("CHANGELOG.md"); const notes = releaseNotes(changelog, releaseVersion); - expect(notes).toContain("### Fixed"); expect(notes).toContain("### Changed"); - for (const issue of [423, 439, 441]) { + for (const issue of [446, 447]) { expect(notes).toContain(`[#${issue}](https://github.com/mohanagy/miftah/issues/${issue})`); } - expect(notes).toContain("client-visible tool schema dialect"); - expect(notes).toContain("JSON Schema 2020-12"); - expect(notes).toContain("forwarded untouched"); - expect(notes).toContain("fast-uri"); - expect(notes).toContain("production-only npm audit"); + expect(notes).toContain("@hono/node-server"); + expect(notes).toContain("dependency refresh rather than a security release"); + expect(notes).toContain("This toolchain work is not published"); expect(notes).toContain("protected OIDC trusted publishing"); expect(notes).toContain("registry provenance"); expect(notes).toContain("does not authorize removal of any legacy behavior"); @@ -105,6 +102,5 @@ describe("v1.1.4 release artifacts", () => { expect(protocolCompatibilityGuide).toContain("initialized Streamable HTTP session assignment"); expect(libraryGuide).toContain("Starting with Miftah 1.0, these public surfaces follow Semantic Versioning"); expect(libraryGuide).toContain("requires a new major release"); - expect(libraryGuide).toContain("requires a new major release"); }); });