You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+30-23Lines changed: 30 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,18 +8,21 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) — [Semantic V
8
8
## [0.2.0] — Unreleased
9
9
10
10
### Added
11
+
11
12
-`dataverse_assign` — assign a record to a different user or team owner via `ownerid@odata.bind`
12
13
-`dataverse_list_teams` — list Dataverse teams with optional filter by team type (Owner / Access / Office / Security)
13
14
-`dataverse_update` now accepts optional `etag` parameter for optimistic concurrency (`If-Match: <etag>`); when omitted, behaviour is unchanged (`If-Match: *`)
14
15
15
16
### Security
17
+
16
18
- MSAL token-cache file now written with `mode: 0o600` (owner read/write only) on POSIX systems
17
19
18
20
---
19
21
20
22
## [0.1.5] — 2026-02-21
21
23
22
24
### Removed
25
+
23
26
- Removed `Dockerfile` and `.dockerignore` — Docker adds unnecessary complexity for an stdio-based MCP server distributed via `npx`; PAC CLI auth (recommended) does not work in containers
24
27
- Removed Docker section from README
25
28
@@ -28,9 +31,11 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) — [Semantic V
28
31
## [0.1.3] — 2025-06-22
29
32
30
33
### Fixed
34
+
31
35
- Server startup crash when installed via `npx` — incorrect `package.json` path resolution from `dist/` (was `../../package.json`, now `../package.json`)
32
36
33
37
### Security
38
+
34
39
-**[HIGH]**`entitySetName` now validated against a safe identifier regex (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`) across all tools — prevents path traversal within same origin (F-01)
35
40
-**[MEDIUM]**`relationshipName` and `relatedEntitySetName` now validated with the same safe identifier regex in relation tools (F-10)
36
41
- Consolidated all inline OData single-quote escaping calls to use the centralized `esc()` utility for consistency (F-06)
@@ -40,33 +45,35 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) — [Semantic V
40
45
## [0.1.0] — 2025-04-01
41
46
42
47
### Added
48
+
43
49
48 tools covering the full Microsoft Dataverse Web API surface:
0 commit comments