kolaente d914a561d6 fix(mcp): build the server per request instead of per session ...

Stateful streamable-HTTP cached the initialize request's context, so every
later call on a session ran as whoever opened it — any mcp:access token plus
a leaked Mcp-Session-Id gave full impersonation, and revoked tokens kept
working through their session. Stateless mode rebuilds the tool set from the
token on each request; resources register at startup instead of lazily.

2026-08-29 00:33:56 +02:00

..

auth

fix(openid): pin token endpoint auth method instead of probing (#3607)

2026-08-27 12:43:11 +00:00

avatar

fix: use caller's session in LoadFileMetaByID to prevent connection pool deadlock

2026-08-16 17:57:52 +02:00

background

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

dump

…

humabridge

fix(api/v2): don't require read_one for autopatch's internal GET

2026-08-19 13:01:59 +02:00

keyvalue

feat(keyvalue): add PutWithTTL to the storage interface

2026-08-19 17:29:35 +02:00

mcp

fix(mcp): build the server per request instead of per session

2026-08-29 00:33:56 +02:00

migration

fix(deps): update module github.com/yuin/goldmark to v2 (#3627)

2026-08-27 20:34:29 +00:00