Miguel Angelo Fernández Iglesias 866469cde3 fix(mcp): address maintainer security review ...

- High: render marketplace links only for http(s) schemes with
  target=_blank/noopener — blocks javascript: DOM-XSS in the webview.
- Restrict registry-provided command to an allowlist of known runners;
  unknown runners are flagged unverified and risky install options show a
  prominent warning banner before adding.
- Trust the 'official' badge only from the outer registry _meta and only
  when it carries structured metadata (not mere key presence).
- Cap HTTP response bodies at 10 MB to prevent memory-exhaustion DoS.
- Send GITHUB_TOKEN only to an exact GitHub host allowlist.
- Copilot import preview now shows the full spec (env/headers included).
- Translate docs/feat/mcp-marketplace.md to English.
- Add McpMarketplaceHttpClientTest and allowlist/official mapper tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-16 04:35:13 +02:00

..

daemon-architecture-refactor.md

feat: add daemon mode to eliminate per-request Node.js process spawning

2026-02-26 22:32:58 +08:00

env-vars-feature.md

Add codex provider extension environment var setting

2026-04-21 11:18:10 +08:00

mcp-marketplace.md

fix(mcp): address maintainer security review

2026-06-16 04:35:13 +02:00

rewind-feature-design.md

feat: implement conversation rewind feature

2026-01-07 23:12:56 +08:00

sdk-lazy-loading-architecture.md

feat: implement SDK lazy loading architecture

2026-01-10 20:40:23 +08:00