Skip to content

Latest commit

 

History

History
717 lines (531 loc) · 53 KB

File metadata and controls

717 lines (531 loc) · 53 KB

Changelog

All notable changes to this project will be documented in this file. Dates are displayed in UTC.

Generated by auto-changelog.

Unreleased

Added
  • Standalone zereight-mcp-gitlab auth device-flow command for SSO / headless OAuth (#591)
  • push_files optional per-file action (create/update/delete/move) and encoding (text/base64); create_or_update_file optional encoding. Existing callers keep action: create and the configured GITLAB_REPO_FILE_ENCODING. GITLAB_PERMISSION_MODE=modify rejects delete and move (based on #513 by @hodyhq)
  • Streamable HTTP GET /mcp SSE listen stream and tools.listChanged capability (#649, #651)
  • Add list_group_members tool for searching group members by name or username (#631)
  • Add list_group_merge_requests tool for listing merge requests across every project of a group and its subgroups
Fixed
  • merge_merge_request no longer strips sha, which GitLab 19.2+ groups may require when merging (#665)
  • list_job_artifacts no longer fails when GitLab returns mode: null on artifact tree entries (#661)
  • create_tag no longer fails when GitLab omits release from the tag response (#653)
Deprecated
  • GITLAB_READ_ONLY_MODE and --read-only=true — use GITLAB_PERMISSION_MODE=readonly or --permission-mode=readonly instead (removed in a future major version)
Breaking changes
  • update_issue now returns a slim confirmation by default; pass full_response=true for the previous full issue object
Added
  • OAUTH_REGISTER_RATE_LIMIT_PER_HOUR — tune per-IP POST /register rate limit when GITLAB_MCP_OAUTH=true (default 20/hour) (#630)
  • health_check reports GitLab instance version from /api/v4/version when authenticated (#617)
  • GITLAB_PERMISSION_MODE with readonly, modify, and full permission tiers
  • Startup new-version notice (disable with GITLAB_DISABLE_VERSION_CHECK=true) (#573)
  • update_issue slim response by default (#572)
Changed
  • fix: sanitize top-level null optional tool arguments before Zod validation (#281)
    • preserve intentional nested nulls (GraphQL variables, diff line numbers, label priority)
    • reject partial merge request position SHAs via schema preprocess instead of silently dropping position
安全
  • GHSA-cv3r-c5h8-f4g5 / CVE-2026-61560: unauthenticated SSE transport plus upload_markdown file_path could exfiltrate server credentials (#554, #482). Upgrade to v2.1.27+ and set SSE_AUTH_TOKEN for SSE deployments.
  • GHSA-5648-rgj9-v224: execute_graphql could bypass read-only mode and GITLAB_ALLOWED_PROJECT_IDS; Streamable HTTP/SSE could expose server GitLab credentials without MCP auth; garbage tokens could exhaust session slots; CI job traces were returned without untrusted framing (#571). Upgrade to v2.1.30+.
  • GHSA-4rm9-rfp2-j39q: download_release_asset direct_asset_path could escape the release download route and reach other GitLab API paths on the same host, bypassing GITLAB_ALLOWED_PROJECT_IDS (#598). Upgrade to v2.1.41+.
Token Optimization & Tool Policy
  • 安全: Refuse unauthenticated Streamable HTTP startup when a server-side GitLab token is configured without MCP-layer authorization
  • Schema slimming (C): Strip $schema and additionalProperties from tool input schemas, reducing per-tool payload by ~40%
  • Tool annotations (E): Add MCP annotations (readOnlyHint, destructiveHint, confirmationHint, openWorldHint) to all tools
  • Tool policy - approve (F): GITLAB_TOOL_POLICY_APPROVE env var / --tool-policy-approve CLI - comma-separated tool names that require _confirmed: true before execution
  • Tool policy - hidden (F): GITLAB_TOOL_POLICY_HIDDEN env var / --tool-policy-hidden CLI - comma-separated tool names excluded from tools/list
  • Dynamic discovery (H): discover_tools meta-tool always available; agents call it to activate toolsets on demand instead of receiving all tools upfront
  • Centralized registry (A/B): tools/registry.ts exports allTools, readOnlyTools, destructiveTools, TOOLSET_DEFINITIONS
  • Audit logging (G): Structured pino logs for every tool call (tool_call_done with duration, tool name)
  • Tests: 34 tests covering schema slimming, raw HTTP annotations, policy edge cases (hidden/approve precedence, regex+hidden combo, annotation overlap), dynamic discovery, and hidden+discover_tools bypass prevention
  • Add include_inheritance support to list_project_members #316
  • feat: approve and unapprove merge requests #308
  • Add cookie file reload and session warmup for proxy authenticationFix cookie warmup #315
  • feat: add excluded_file_patterns parameter to get_merge_request_diffs #313
  • fix: remove obsolete readonly MCP tests and update test scripts b72bc76
  • refactor: extract filterDiffsByPatterns util and add ReDoS protection f1adeec
  • ci: add test:mock to PR validation workflow 78ac4a6

15 January 2026

  • feat(gitlab): expose merge request version tools #272
  • feat(docker): add Docker support with example environment and README #270
  • fix: make create_draft_note position parameter flexible #269
  • feat: add CLI arguments support for configuration #291
  • refactor: unify test scripts structure #304
  • refactor: fix deprecated lint issues and security vulnerability #303
  • fix: update dependencies for @modelcontextprotocol/sdk and add @hono/node-server 3a07d08
  • fix: use getEffectiveApiUrl and getFetchConfig in MR version functions bc205a5
  • fix: restore original package name and remove fork references 0c001f5

4 January 2026

  • ci: add missing tests to PR workflow #302
  • refactor(list_merge_requests): improve code quality and docs #301
  • feat: allow global merge request listing (optional project_id) #293
  • chore(deps): bump qs from 6.14.0 to 6.14.1 #300

21 December 2025

  • fix: change default HOST from 0.0.0.0 to 127.0.0.1 #289
  • chore(deps-dev): bump js-yaml #296
  • chore(deps): bump body-parser #297
  • ci: remove matrix strategy and unify Node.js to 22.21.1 in all workflows c8c2ac7
  • chore: remove 'peer' property from multiple dependencies in package-lock.json 6d56742
  • chore: update step 2 image in documentation b235c32

20 December 2025

20 December 2025

  • feat: add OAuth2 support and update documentation 52661c4
  • feat: add OAuth2 configuration examples and update documentation for Docker deployments 1f6f2f8

20 December 2025

  • chore: bump version to 2.0.18 and update changelog 55c7896
  • ci: upgrade npm for OIDC trusted publishing support cf4a57f

20 December 2025

  • chore: bump version to 2.0.17 and update changelog d4cef6e
  • ci: update npm-publish to use OIDC trusted publishing 4eabe16

20 December 2025

  • Revert to npm registry and add OTP support df5b223

20 December 2025

  • Switch publishing to GitHub 包 a2b7882

20 December 2025

  • Add support for dynamic GitLab API URLs and connection pooling #290
  • Update changelog for v2.0.14 e10a3bc
  • Bump version to 2.0.14 124ba79
  • Add gitignore entry for local docs c0d20d1

24 November 2025

  • chore: bump version to 2.0.12 in package.json and update CHANGELOG 1d9d6ae
  • chore: bump version to 2.0.13 in package.json and package-lock.json 3f33859

23 November 2025

  • fix: pin zod-to-json-schema to 3.24.5 to prevent breakage from v3.25.0 #285

7 November 2025

  • Fix #266 #273
  • Support Oauth client authentication with Gitlab #261
  • Fix #266 (#273) #266
  • chore: bump version to 2.0.11 in package.json and update CHANGELOG 9202826

7 November 2025

5 November 2025

  • Added documentation integration with strands agents mcp tools #265
  • Fix regex for GitLab PAT token validation #267
  • feat(gitlab): GitLab Merge Request Notes and 讨论: Full CRUD + Thread Resolution #260
  • chore: bump version to 2.0.8 in package.json and update CHANGELOG 3656011
  • chore: bump version to 2.0.9 in package.json 88b8a1b

27 October 2025

  • feat: implement gitlab releases endpoint #259
  • Add support for remote authorization in Streamable HTTP transport #258
  • docs: update CHANGELOG for version 2.0.7 3bb35ab
  • ci: add remote auth tests to PR workflow db4f724
  • 릴리즈배포의 서브태스크 (vibe-kanban 06e3f5cb) 4d66c93

11 October 2025

  • execute graphql #253
  • removed flexibleBoolean and replaced with z.boolean() #251
  • Squashed commit of the following: ba4dfcf
  • bump version to 2.0.7 in package.json a794e28

20 September 2025

  • Fix/inline schemas #242
  • Add "full_diff" parameter to get_commit_diff so we can retreive more than 20 files #244
  • refactor(schemas): replace custom boolean validators with native zod boolean #245
  • Feat/add delete to streamhttp #246
  • Fix: Add 'logic' and 'style' line types to enum for mr_discussions #248
  • bump version to 2.0.5 and update dependencies in package-lock.json d1d3f1a
  • Bump version to 2.0.6 in package.json 7a3f89f

9 September 2025

  • Add ability to trigger / retry / cancel individual jobs #233
  • chore: add expose to docker file #222
  • Pull Request: Add GitLab Events API Tools #235
  • bump version to 2.0.5 in package.json 3e1bdd1
  • docs: update README to include new pipeline-related tools f051153

31 August 2025

  • Fixes coverage parsing error on Pipelines related types #230
  • FEAT: add GITLAB_DENIED_TOOLS_REGEX env to disable some tools #206
  • Feat/modify email #225
  • v1.0.77 #209
  • FIX: docker hub repo user name #210
  • feat: Add NPM publish workflow for automated package publishing #208
  • Fix list of tools in README.md #205
  • FIX: flexible boolean #201
  • feat(attachement):download attachement, e.g. images #200
  • FEAT: merge MR #193
  • FEAT: get draft note #197
  • feat: Add createDraftNote api support, useful for bulk code review #183
  • feat: add my_issues and list_project_members tools #133
  • feat(pipeline): Add list_pipeline_trigger_jobs tools #194
  • (feat): add tool to upload file for markdown content #196
  • Bump version to 1.0.76 #182
  • FEAT: iteration #179
  • Bump version to 1.0.75 #178
  • Allow accessing issues without project id #168
  • Feat/deploy script #176
  • FEAT: target project on create MR #174
  • Bump version to 1.0.74 #175
  • FEAT: add logging #162
  • FEAT: id is string or number #161
  • FIX string or number #160
  • FIX: id string or number #158
  • FIX: deploy script #156
  • chore: Bump version 1.0.72 #154
  • FEAT: enable string for boolean for claude #150
  • Bump version to 1.0.71 #152
  • tag with image push #151
  • FIX: string | number for gemini #149
  • FIX: format boolean for claude #148
  • Print logs to stderr #147
  • FIX: CreateMergeRequestSchema #146
  • chore: Bump version to 1.0.70 #145
  • FIX: sse #144
  • FIX: default project id #141
  • FEAT: format boolean #143
  • FIX: console to stderr #135
  • FIX: create pipeline #138
  • FEAT: Add support for Streamable HTTP transport #128
  • FIX: notable iid #126
  • FEAT: reviewer on update MR #118
  • FEAT: not call create fork repo on set default project id #116
  • FEAT: project id , vscode doc #113
  • feat(simple healthcheck): #112
  • FIX: new,old path nullable #108
  • fix: avoid error caused by line_range type: null in discussion #107
  • FIX: sse readme #103
  • FEAT: mr discussion with code diff #93
  • feat: add cookie-based authentication support for enterprise GitLab #101
  • Fix notification_level null handling for GitLab group owners #99
  • feat: add pagination support for CI job logs to prevent context window flooding #97
  • FIX: private token auth #91
  • FEAT: private token auth #89
  • FIX: list issues assginee username #87
  • FEAT: add support for remove_source_branch and squash options for merge requests #86
  • Fix for null error #85
  • FIX: bug get issues #83
  • Add support for retrieving wiki page content in list_wiki_pages #82
  • DOC: readme docker image #81
  • Add pagination to merge request discussions, similar to issue discussions #80
  • fix: merge_requests_template can be null #79
  • FIX: issue param #78
  • FIX: get issues labels #77
  • FEAT: MCP SSE #76
  • Feat: Enrich Merge Request Creation #68
  • Feat/custom ssl #72
  • FEAT: multi platform #71
  • FEAT: ci push docker hub #65
  • feat: add pipeline management commands #64
  • [main] docs: update README with comments on GITLAB configuration options #63
  • test #61
  • Fix GitHub 操作 workflow syntax errors #62
  • feat: add tools for milestones #59
  • FEAT: docker image push script #60
  • fix(schemas): make illustration nullable in GitLabPipelineSchema #58
  • feat: implement list_merge_requests functionality #56
  • fix(schemas): make avatar_url nullable in GitLabUserSchema #55
  • FIX: description null error #53
  • feat(release): 1.0.44 adds pipeline jobs tool #52
  • feat: add support for creating and updating issue notes #47
  • fix: fix README #45
  • feat: add issue discussions support #44
  • feat: add docker image and push to dockerhub #42
  • fixed resolve_outdated_diff_discussions nullable #41
  • fix: add expanded to start and end for GitLabDiscussionNoteSchema #40
  • Adds threaded comment support for merge requests #38
  • Support resolving merge request discussion notes #37
  • feat: Gitlab list repository tree tool #35
  • feat: support search by branch for get_merge_request #34
  • feat: Implement proxy configuration for HTTP/HTTPS/SOCKS #33
  • feat: Add read-only mode support #29
  • Add schemas for GitLab discussion notes and merge request discussions #26
  • ✨ Add list_group_projects tool #25
  • Update README.md #24
  • Fixed types for create_merge_request and get_merge_request tools. #23
  • Authentication Header Consistency Fix #22
  • 标签 API Support #21
  • Improve README documentation with detailed tool descriptions #18
  • Implement GitLab 问题 and Issue Links API #17
  • Add GitLab 项目 API support #16
  • Add GitLab Namespaces API support #15
  • Fix GitLab API fork repository parameter handling #14
  • Fix GitLab API parameter handling in create_or_update_file #13
  • Improve code documentation with bilingual JSDoc comments #11
  • Fix URL construction with smart API URL normalization #10
  • Fix createNote function URL construction: use plural resource names and avoid duplicate /api/v4 #7
  • Added missing api url part to create_note #3
  • Deployment: Dockerfile and Smithery config #2
  • add MCP server badge #1
  • [feat/pipeline-support] feat: add pipeline management commands #46
  • chore: update CHANGELOG for version 2.0.4 e26c169
  • Squashed commit of the following: 73f21db
  • Squashed commit of the following: 750e1c6

17 August 2025

  • fix: Update Docker image repository name in workflow b97b264
  • chore: Update version to 2.0.3 in package.json 196aee3

15 August 2025

  • chore: update version in package.json to 2.0.2 0c5e667
  • chore: update version in CHANGELOG to 2.0.1 e3b0144

15 August 2025

  • v1.0.77 #209
  • FIX: docker hub repo user name #210
  • feat: Add NPM publish workflow for automated package publishing #208
  • Fix list of tools in README.md #205
  • Squashed commit of the following: 291fb10
  • Fix list of tools 4ab6eb1
  • fix: update Docker Hub repository username in workflow 4ed895b

15 August 2025

  • User based authentication methods #130
  • feat: update version to 2.0.0-canary.0 1751d1d
  • fix: update version to 2.0.0 in package.json and package-lock.json cce5d07
  • fix: update version to 2.0.0-beta.0 and rename deploy scripts d5a652d

13 August 2025

  • feat: Add NPM publish workflow for automated package publishing #208
  • Fix list of tools in README.md #205
  • FIX: flexible boolean #201
  • feat(attachement):download attachement, e.g. images #200
  • FEAT: merge MR #193
  • FEAT: get draft note #197
  • feat: Add createDraftNote api support, useful for bulk code review #183
  • feat: add my_issues and list_project_members tools #133
  • feat(pipeline): Add list_pipeline_trigger_jobs tools #194
  • (feat): add tool to upload file for markdown content #196
  • Fix list of tools 4ab6eb1
  • feat: replace GITLAB_LOCK_PROJECT with GITLAB_ALLOWED_PROJECT_IDS 009ad97
  • feat: add GITLAB_LOCK_PROJECT environment variable c899a7d

25 July 2025

  • Bump version to 1.0.76 #182
  • FEAT: iteration #179
  • Bump version to 1.0.75 #178
  • Merge pull request #181 from zereight/feat/166-1 6adbeea
  • FIX 46f8405
  • FIX: default null 6e82e7e

18 July 2025

  • Allow accessing issues without project id #168
  • Feat/deploy script #176
  • FEAT: target project on create MR #174
  • Bump version to 1.0.74 #175
  • FIX 2872aed
  • fix(list_issues): make project_id optional b242522
  • Bump version to 1.0.75 b0411ba

17 July 2025

13 July 2025

9 July 2025

  • chore: Bump version 1.0.72 #154
  • FEAT: enable string for boolean for claude #150
  • Bump version to 1.0.71 #152
  • tag with image push #151
  • FIX: string | number for gemini #149
  • FIX: format boolean for claude #148
  • Print logs to stderr #147
  • FIX: CreateMergeRequestSchema #146
  • chore: Bump version to 1.0.70 #145
  • FIX: sse #144
  • FIX: default project id #141
  • FEAT: format boolean #143
  • FIX: console to stderr #135
  • FIX: create pipeline #138
  • FEAT: Add support for Streamable HTTP transport #128
  • FIX: notable iid #126
  • FEAT: reviewer on update MR #118
  • FEAT: not call create fork repo on set default project id #116
  • FEAT: project id , vscode doc #113
  • feat(simple healthcheck): #112
  • FIX: new,old path nullable #108
  • fix: avoid error caused by line_range type: null in discussion #107
  • FIX: sse readme #103
  • REVIEW FIX 3ad2954
  • fix: avoid error caused by line_range: null in discussion d50b7fd
  • FIX b109392

16 June 2025

  • FEAT: mr discussion with code diff #93
  • docs: update README and version to 1.0.64 cced1c1

16 June 2025

  • feat: add cookie-based authentication support for enterprise GitLab #101
  • Fix notification_level null handling for GitLab group owners #99

12 June 2025

  • docs: add CHANGELOG entry for v1.0.63 8d70627

12 June 2025

  • feat: add pagination support for CI job logs to prevent context window flooding #97
  • [version-update] fix: correct Private-Token header authentication for GitLab API 🔐 3c23675
  • chore: bump version to 1.0.63 62f0fff

10 June 2025

  • FIX: private token auth #91
  • FEAT: private token auth #89
  • style: format code for consistency and readability ✨ 1ba5434
  • [version-update] feat: bump version to 1.0.60 🎉 29659db
  • [version-update] feat: bump version to 1.0.62 🎉 8df87c6

7 June 2025

  • FIX: list issues assginee username #87
  • FEAT: add support for remove_source_branch and squash options for merge requests #86

4 June 2025

  • Fix for null error #85
  • FIX: bug get issues #83
  • Add support for retrieving wiki page content in list_wiki_pages #82
  • DOC: readme docker image #81
  • [version-update] feat: bump version to 1.0.59 🎉 0930ce3
  • [feat] update: bump version to 1.0.58 8cb7703

3 June 2025

  • Add pagination to merge request discussions, similar to issue discussions #80
  • fix: merge_requests_template can be null #79
  • [feat] update: bump version to 1.0.57 c07356b

2 June 2025

  • FIX: issue param #78
  • FIX: get issues labels #77
  • FEAT: MCP SSE #76
  • Feat: Enrich Merge Request Creation #68
  • feat: add branch comparison functionality and update related schemas c834ebc
  • fix: remove duplicate entry for get_branch_diffs in tools list 6bc1379
  • feat: add user retrieval functions and schemas for GitLab API integration 005b46a

31 May 2025

  • Feat/custom ssl #72
  • FEAT: multi platform #71
  • Release v1.0.54: Add multi-platform support and custom SSL configuration 459161e
  • chore: remove outdated release notes for version 1.0.40 e9493b2
  • [main] chore: bump version to v1.0.54 🚀 4a8088c

30 May 2025

  • FEAT: ci push docker hub #65
  • [main] fix: make old_line and new_line optional for image diff discussions cb36c00
  • [main] chore: bump version to v1.0.53 fcb71e2

30 May 2025

  • feat: add pipeline management commands #64
  • [main] docs: update README with comments on GITLAB configuration options #63
  • test #61
  • Fix GitHub 操作 workflow syntax errors #62
  • [feat/pipeline-support] feat: add pipeline management commands #46
  • [feat/pipeline-support] feat: add USE_PIPELINE environment variable for conditional pipeline feature activation de0b138
  • [main] docs: update README to remove automated testing section 📝 37203ba
  • [main] debug: temporarily disable MCP server startup test 8e2b6e6

29 May 2025

  • [main] feat: update milestone management tools and improve code formatting ✨ 181f1e9

29 May 2025

  • feat: add tools for milestones #59
  • FEAT: docker image push script #60
  • [main] chore: v1.0.48 버전 업데이트 2a80988
  • feat: add milestone management commands to README 5762b32

29 May 2025

  • fix(schemas): make illustration nullable in GitLabPipelineSchema #58
  • feat: implement list_merge_requests functionality #56
  • fix(schemas): make avatar_url nullable in GitLabUserSchema #55
  • feat: implement list_merge_requests functionality cc84777
  • [main] release: v1.0.47 a2c2ac1

27 May 2025

  • FIX: description null error #53
  • [main] fix: description null error handling f8b1444

24 May 2025

  • feat(release): 1.0.44 adds pipeline jobs tool #52
  • chore(release): 1.0.43 - get_repository_tree is added read_only_mode 1406203
  • [main] docs: update changelog for v1.0.45 pipeline tools 8ba3398
  • docs: translate issue notes changelog from Korean to English 3d7aa80

22 May 2025

  • feat: add support for creating and updating issue notes #47
  • fix: fix README #45
  • chore(release): 1.0.42 - issue note 기능 추가 (#47) 25be194
  • docs: update release notes for v1.0.40 (2025-05-21) b326f4c

21 May 2025

  • feat: add issue discussions support #44

20 May 2025

  • feat: add docker image and push to dockerhub #42
  • fixed resolve_outdated_diff_discussions nullable #41
  • docs: add release-notes.md 676bbcd
  • 버전 1.0.39로 업데이트 e4a28a9

17 May 2025

  • fix: add expanded to start and end for GitLabDiscussionNoteSchema #40
  • Bump version 0bb59a3

15 May 2025

  • Adds threaded comment support for merge requests #38
  • Support resolving merge request discussion notes #37
  • feat: Add create_merge_request_thread tool for diff notes 026dd58
  • feat: Implement add_merge_request_thread_note function for adding notes to existing MR threads 3f2b355
  • feat: support resolving merge request notes bde83c0

13 May 2025

  • feat: Decode project_id for GitLab API calls 08ab135
  • [main] refactor: update label_id schema to use string type bf250b0
  • [main] chore: update version to 1.0.35 🚀 651072d

7 May 2025

  • feat: Gitlab list repository tree tool #35
  • feat: support search by branch for get_merge_request #34
  • fix: rename to source branch 7b8cbc0
  • [main] docs: update README with detailed descriptions for merge request functions 3a25e7c
  • [main] chore: update version to 1.0.34 23a9bbc

1.0.32

25 April 2025

  • feat: Implement proxy configuration for HTTP/HTTPS/SOCKS #33
  • feat: Add read-only mode support #29
  • Add schemas for GitLab discussion notes and merge request discussions #26
  • ✨ Add list_group_projects tool #25
  • Update README.md #24
  • Fixed types for create_merge_request and get_merge_request tools. #23
  • Authentication Header Consistency Fix #22
  • 标签 API Support #21
  • Improve README documentation with detailed tool descriptions #18
  • Implement GitLab 问题 and Issue Links API #17
  • Add GitLab 项目 API support #16
  • Add GitLab Namespaces API support #15
  • Fix GitLab API fork repository parameter handling #14
  • Fix GitLab API parameter handling in create_or_update_file #13
  • Improve code documentation with bilingual JSDoc comments #11
  • Fix URL construction with smart API URL normalization #10
  • Fix createNote function URL construction: use plural resource names and avoid duplicate /api/v4 #7
  • Added missing api url part to create_note #3
  • Deployment: Dockerfile and Smithery config #2
  • add MCP server badge #1
  • build: test-note.js 파일 삭제 61ee124
  • Add compiled JavaScript files for Issue Links API schema fix a4d7795
  • Build upd. 5d10401