diff --git a/NEWS.md b/NEWS.md index dc33e47..78d59ea 100644 --- a/NEWS.md +++ b/NEWS.md @@ -8,6 +8,20 @@ --- +## October 26, 2026 + +### Features + +### Changes + +### Fixes + +- **Installs alongside Cloud Custodian again**: you can install stacklet-mcp in the same + environment as Cloud Custodian again. If installing the October 23 release failed for + you, upgrade to this release. + +--- + ## October 23, 2026 ### Features @@ -16,37 +30,38 @@ Stacklet's IaC Governance from the Stacklet documentation. When the documentation does not cover something, it says so instead of guessing. - **See which tools can change things**: AI apps that support it can now show which - Stacklet tools only read your data and which can make changes, so you can choose to + Stacklet tools only read your data and which can make changes. You can then choose to approve changes before they happen. AssetDB queries count as able to make changes, - because what a query can do depends on your database permissions, so your app may ask - before it runs one. + because your database permissions decide what a query can do. Your app may ask before + it runs one. ### Changes - **Private dataset exports**: only the person who starts a dataset export can download - it, and they must be signed in to Stacklet. Your assistant still downloads finished + it. They must be signed in to Stacklet. Your assistant still downloads finished exports for you, using your Stacklet sign-in. If an export has expired, or belongs to someone else, you now get a clear message instead of a broken link. - **Simpler saved query results**: when your assistant saves the full results of an - AssetDB query to a file, the file now holds just the rows, which is easier to open in - other tools. If you have scripts that read these files, check them against the new + AssetDB query to a file, the file now holds just the rows. That makes it easier to open + in other tools. If you have scripts that read these files, check them against the new format. Links to download query results now work only for people signed in to Stacklet. - **Fewer startup errors on Windows**: the configuration that `stacklet-mcp agent-config` - generates now avoids text encoding errors when your AI app starts the server. + generates now avoids text encoding errors when your AI app starts the server. If you + created your configuration with an earlier release, run + `stacklet-mcp agent-config generate default` (or `unrestricted`) again, and replace your + app's Stacklet configuration with the output. ### Fixes - **AssetDB queries work on more Stacklet deployments**: some deployments could not run AssetDB queries at all. The server now finds AssetDB on its own. -- **Fewer failed GraphQL queries**: when your assistant writes a query that asks for data - Stacklet does not have, it now gets a clear explanation and can correct the query - itself. -- **Fresh installs start again**: installing stacklet-mcp into a new environment could - pull in a newer, incompatible version of a library it depends on, and the server would - not start. Installs now get a compatible version. -- **Security updates**: stacklet-mcp now requires a version of certifi, its list of - trusted certificate authorities, that no longer trusts the compromised eMudhra - authority. Other dependencies are updated to pick up security fixes. +- **Fewer failed GraphQL queries**: when your assistant asks for a kind of data Stacklet + does not have, it now gets a clear explanation. It can then correct the query itself. +- **Fresh installs start again**: a new install of stacklet-mcp could pick up an + incompatible library version, and the server would not start. Installs now get a + compatible version. +- **Security updates**: stacklet-mcp no longer trusts the compromised eMudhra certificate + authority. We also updated other libraries to pick up their security fixes. --- diff --git a/pyproject.toml b/pyproject.toml index 39940ff..fd50135 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -18,15 +18,14 @@ classifiers = [ dynamic = [ "version" ] dependencies = [ "certifi>=2026.10.19", # httpx's CA bundle; earlier releases trust the compromised eMudhra CA - "cryptography>=50.0.2", # not imported directly; minimum for CVE fixes - "fastmcp>=3.3.1,<4", # minimum for security fixes; fastmcp 4 removes APIs we import + "cryptography>=50", # not imported directly; CVE-2026-69247 fixed in 50.0.0 + "fastmcp>=3.2,<4", # 3.2.0 fixes the advisories that affect us; fastmcp 4 removes APIs we import "graphql-core>=3.2", "httpx>=0.28.1", - "platformdirs>=4.13", # not imported directly; minimum for CVE fixes "pydantic>=2.11.7", "pydantic-settings>=2.13,<2.14", - "pyjwt>=2.15.1", # not imported directly; minimum for CVE fixes - "starlette>=1.8", # not imported directly; minimum for CVE fixes + "pyjwt>=2.15", # not imported directly; CVE-2026-101918 and CVE-2026-102275 fixed in 2.15.0 + "starlette>=1.3.1", # not imported directly; CVE-2026-54283 fixed in 1.3.1 ] scripts.stacklet-mcp = "stacklet.mcp.mcp:main" diff --git a/stacklet/mcp/__init__.py b/stacklet/mcp/__init__.py index bd97ad2..5ecbf5e 100644 --- a/stacklet/mcp/__init__.py +++ b/stacklet/mcp/__init__.py @@ -5,7 +5,7 @@ """Stacklet MCP server.""" -__version__ = "2026.10.23" +__version__ = "2026.10.26" USER_AGENT = f"stacklet.mcp/{__version__}" diff --git a/uv.lock b/uv.lock index aa09dce..9108fe9 100644 --- a/uv.lock +++ b/uv.lock @@ -1579,7 +1579,6 @@ dependencies = [ { name = "fastmcp" }, { name = "graphql-core" }, { name = "httpx" }, - { name = "platformdirs" }, { name = "pydantic" }, { name = "pydantic-settings" }, { name = "pyjwt" }, @@ -1605,15 +1604,14 @@ dev = [ [package.metadata] requires-dist = [ { name = "certifi", specifier = ">=2026.10.19" }, - { name = "cryptography", specifier = ">=50.0.2" }, - { name = "fastmcp", specifier = ">=3.3.1,<4" }, + { name = "cryptography", specifier = ">=50" }, + { name = "fastmcp", specifier = ">=3.2,<4" }, { name = "graphql-core", specifier = ">=3.2" }, { name = "httpx", specifier = ">=0.28.1" }, - { name = "platformdirs", specifier = ">=4.13" }, { name = "pydantic", specifier = ">=2.11.7" }, { name = "pydantic-settings", specifier = ">=2.13,<2.14" }, - { name = "pyjwt", specifier = ">=2.15.1" }, - { name = "starlette", specifier = ">=1.8" }, + { name = "pyjwt", specifier = ">=2.15" }, + { name = "starlette", specifier = ">=1.3.1" }, ] [package.metadata.requires-dev]