joeyr/mcp-gateway
1
0
Fork 0
Code Issues Pull requests Projects Releases 121 Packages 1 Wiki Activity Actions
121 releases 129 tags
  • v0.58.1 e02c5e69ef

    v0.58.1 Stable

    joeyr released this 2026-09-22 00:48:51 -05:00 | 40 commits to main since this release

    0.58.0's gate went red, and the check that caught it could not have caught it before the
    commit.     A coordinate-shaped literal — Open-Meteo's own model-cell position, quoted from a
    live measurement into a docstring — went into weather/model.py. The full suite was green
    locally and red on the first CI run, and the difference is the whole finding:
    test_no_pii.py asked git ls-files, which lists what is tracked, so all eight files
    0.58.0 added were invisible to every rule in that file until the commit that published
    them.

    A guard whose scope is "what is published" has to run on what is ABOUT to be published.
    One that waits for the commit reports the leak instead of preventing it — and reports it
    from CI rather than from the keyboard, after the value has reached a public remote.

    Fixed

    • The literal is gone from weather/model.py, replaced by a description of the value's
      shape. That is CLAUDE.md's own instruction for this case: describe the shape instead.
      Nothing read the number; it was there to record what the endpoint answers.
    • test_no_pii.py now also walks git ls-files --others --exclude-standard, so the set
      it scans is what a git add -A would put in the repo rather than what is already in it.
      --exclude-standard applies .gitignore, so every false positive that function's
      docstring lists — .env, probes/, a scrub script — stays excluded exactly as before.
      Proved by putting a coordinate in an untracked file and watching the rule go red, then
      removing it.

    Changed

    • The 48 weather tests added in 0.58.0 are async def rather than asyncio.run, which
      is what the other 107 in that file already were. pyproject.toml's own filterwarnings
      comment says fastmcp's in-memory transport leaks one half of an anyio stream and that GC
      timing decides which test the warning lands on      , so left fatal it fails a different
      unrelated test each run. Building and tearing down an event loop per test changes exactly
      that timing, repo-wide, for no benefit — and it put those tests on a different footing
      from every other test in the file.

    No behaviour change. The nine tools, their responses and their descriptions are
    byte-identical to 0.58.0; this is the gate and the test suite.

    0.58.0 published no image, because image has needs: gate. So the running container
    is still 0.57.3 until this one goes green, and the deploy plus connector reconnect that
    0.58.0's entry describes applies to this version instead.

    Downloads