kolaente d914a561d6 fix(mcp): build the server per request instead of per session ...

Stateful streamable-HTTP cached the initialize request's context, so every
later call on a session ran as whoever opened it — any mcp:access token plus
a leaked Mcp-Session-Id gave full impersonation, and revoked tokens kept
working through their session. Stateless mode rebuilds the tool set from the
token on each request; resources register at startup instead of lazily.

2026-08-29 00:33:56 +02:00

..

audit

…

caldav

…

caldavtests

fix(caldav): don't duplicate a task when a client PUTs a stale href

2026-08-18 12:55:13 +02:00

cmd

…

config

fix(ratelimit): give session renewal its own budget

2026-08-18 14:01:06 +02:00

cron

…

db

feat(mcp): add users_search tool for assignee and share discovery

2026-08-29 00:02:46 +02:00

doctor

feat: report ParadeDB extension and index status in doctor command

2026-08-05 19:27:12 +02:00

e2etests

fix(e2etests): drain pending event handlers before seeding fixtures

2026-08-27 13:36:08 +02:00

events

fix(events): don't log event payloads in the poison queue handler

2026-08-20 08:45:42 +02:00

files

fix: use caller's session in LoadFileMetaByID to prevent connection pool deadlock

2026-08-16 17:57:52 +02:00

health

…

i18n

feat(notifications): notify subscribers when a task is created

2026-08-27 15:41:58 +02:00

initialize

…

license

…

log

…

mail

fix(user): keep old email active until new one is confirmed

2026-08-18 22:03:38 +02:00

metrics

fix(metrics): store active users as TTL keys in keyvalue to avoid concurrent map access

2026-08-19 17:29:35 +02:00

migration

fix(deps): update module github.com/yuin/goldmark to v2 (#3627)

2026-08-27 20:34:29 +00:00

models

feat(mcp): expose expand on tasks_read_all

2026-08-29 00:05:16 +02:00

modules

fix(mcp): build the server per request instead of per session

2026-08-29 00:33:56 +02:00

notifications

fix(deps): update module github.com/yuin/goldmark to v2 (#3627)

2026-08-27 20:34:29 +00:00

plugins

fix(plugins): exclude example plugin from module build

2026-08-20 16:51:01 +02:00

red

…

richtext

fix(deps): update module github.com/yuin/goldmark to v2 (#3627)

2026-08-27 20:34:29 +00:00

routes

fix(mcp): build the server per request instead of per session

2026-08-29 00:33:56 +02:00

swagger

[skip ci] Updated swagger docs

2026-08-19 00:53:08 +00:00

user

fix(user): expire used TOTP passcodes via keyvalue TTL

2026-08-19 17:29:35 +02:00

utils

feat(migration): client-aware get and size-limited download helpers, bounded json decode

2026-08-20 08:45:42 +02:00

version

…

web

…

websocket

…

webtests

fix(mcp): build the server per request instead of per session

2026-08-29 00:33:56 +02:00

yaegi_symbols

[skip ci] Updated yaegi symbols

2026-08-27 16:46:50 +00:00