fix: repair Hevy audit findings and dependency security (v0.5.0)

jlxq0 commented

2026-10-24 02:19:02 +00:00

Owner

Hevy failures previously lost upstream HTTP details and classified missing/conflicting resources as invalid parameters; initialization identified the rmcp SDK, and each template search fetched every page again. This release exposes bounded key-redacted JSON diagnostics and distinct error classes, reports hevy-mcp 0.5.0 in initialize/health, and caches complete template lists per full key digest for five minutes with bounded retention and create invalidation. Rate-limit errors remain errors; no retries are added.

Six targeted lockfile updates clear 11 vulnerabilities plus Tokio unsoundness/yanked chacha20 while retaining the Rust 1.93 build floor and existing reqwest/rmcp features. Removes the unused Matrix URL module and account-specific instructions. Documents public error/version/cache behavior and two closeout conventions.

Validation: cargo +1.98.0 fmt --all --check; cargo +1.98.0 clippy --all-targets --all-features --locked -- -D warnings; cargo +1.98.0 test --all-features --locked (58 passed); cargo +1.93.0 check --all-features --locked; cargo audit; cargo deny check; git diff --check. Wiremock covers all workout/routine write bodies, multi-page search, cache key isolation/expiry/invalidation/admission/error nonretention, history/folders; MCP wire tests cover identity and error diagnostics/classes, including control-character redaction regression. Existing auth/host/quota tests pass. Twelve tests removed belonged to the deleted unused module; eleven behavior tests added.

Independent pre-PR read-only review found two issues (normalization after redaction; caching an empty nonfinal page). One rework fixed both with regressions; reviewer independently confirmed 58 passing tests and no remaining concrete concern. Branch protection and CI workflow unchanged.

Limits: cached searches can reflect pre-revocation data for up to five minutes; external template changes have the same TTL, and concurrent misses can fetch independently. Quinn advisories were lockfile-only, absent the default built graph. No real workout writes performed. Real valid-key Claude client read-only proof is pending Clark access card t_7c4c63ff; dummy-bearer probes and mocks are not that proof. This PR does not close the rollout/client-proof gate.

Tracks #16 and fleet t_9d164f0d. Versioned release is authorized after exact-head CI and protected merge.

Hevy failures previously lost upstream HTTP details and classified missing/conflicting resources as invalid parameters; initialization identified the rmcp SDK, and each template search fetched every page again. This release exposes bounded key-redacted JSON diagnostics and distinct error classes, reports hevy-mcp 0.5.0 in initialize/health, and caches complete template lists per full key digest for five minutes with bounded retention and create invalidation. Rate-limit errors remain errors; no retries are added. Six targeted lockfile updates clear 11 vulnerabilities plus Tokio unsoundness/yanked chacha20 while retaining the Rust 1.93 build floor and existing reqwest/rmcp features. Removes the unused Matrix URL module and account-specific instructions. Documents public error/version/cache behavior and two closeout conventions. Validation: cargo +1.98.0 fmt --all --check; cargo +1.98.0 clippy --all-targets --all-features --locked -- -D warnings; cargo +1.98.0 test --all-features --locked (58 passed); cargo +1.93.0 check --all-features --locked; cargo audit; cargo deny check; git diff --check. Wiremock covers all workout/routine write bodies, multi-page search, cache key isolation/expiry/invalidation/admission/error nonretention, history/folders; MCP wire tests cover identity and error diagnostics/classes, including control-character redaction regression. Existing auth/host/quota tests pass. Twelve tests removed belonged to the deleted unused module; eleven behavior tests added. Independent pre-PR read-only review found two issues (normalization after redaction; caching an empty nonfinal page). One rework fixed both with regressions; reviewer independently confirmed 58 passing tests and no remaining concrete concern. Branch protection and CI workflow unchanged. Limits: cached searches can reflect pre-revocation data for up to five minutes; external template changes have the same TTL, and concurrent misses can fetch independently. Quinn advisories were lockfile-only, absent the default built graph. No real workout writes performed. Real valid-key Claude client read-only proof is pending Clark access card t_7c4c63ff; dummy-bearer probes and mocks are not that proof. This PR does not close the rollout/client-proof gate. Tracks #16 and fleet t_9d164f0d. Versioned release is authorized after exact-head CI and protected merge.

jlxq0 added 1 commit

2026-10-24 02:19:02 +00:00

fix: repair audited Hevy errors, template reads and dependencies (v0.5.0)

CI / cargo (pull_request) Successful in 3m6s

Details

CI / docker (pull_request) Successful in 1m35s

Details

b8777321c4

jlxq0 referenced this pull request

2026-10-24 02:19:02 +00:00

Repair audit findings: dependency security, errors, identity and template reads #16

jlxq0 merged commit 4444b987bb into main