摘要
本版本修复了 CodeQL 和 Dependabot 标记的剩余安全告警,包括路径注入、原型污染、速率限制、SSRF 和 OAuth PKCE 等问题,并通过脱敏日志记录器加固了日志管线。同时,日志消息现在会进行字符串化处理,以便更好地阅读。
修复
- 使用脱敏日志记录器和加固措施关闭 CodeQL 告警 by @samanhappy in https://github.com/samanhappy/mcphub/pull/1065
- 修复 CodeQL 路径注入、原型污染和速率限制告警 by @samanhappy in https://github.com/samanhappy/mcphub/pull/1066
- 通过更新易受攻击的传递依赖解决 Dependabot 告警 by @samanhappy in https://github.com/samanhappy/mcphub/pull/1067
- 使用 CodeQL 可识别的防护屏障关闭剩余 12 个告警 by @samanhappy in https://github.com/samanhappy/mcphub/pull/1068
- 关闭未处理的安全公告发现(SSRF、授权、OAuth PKCE)by @samanhappy in https://github.com/samanhappy/mcphub/pull/1069
- 字符串化日志消息以提高可读性 by @samanhappy in https://github.com/samanhappy/mcphub/pull/1070