|
1 | | -# v0.8.3 Release Notes |
2 | | - |
3 | | -### 🚀 New Features & Improvements |
4 | | - |
5 | | -- **Enhanced workspace tasks filtering with Views API support (Issue #43)**: |
6 | | - - **Enhanced list filtering**: When `list_ids` are provided, `get_workspace_tasks` now uses ClickUp's Views API for comprehensive task coverage |
7 | | - - **Multi-list task support**: Now retrieves tasks that are *associated with* specified lists, including tasks created elsewhere and added to multiple lists |
8 | | - - **Two-tier filtering strategy**: |
9 | | - - **Server-side filtering**: Supported filters applied at ClickUp API level for efficiency (statuses, assignees, dates, etc.) |
10 | | - - **Client-side filtering**: Additional filters applied after data retrieval (tags, folder_ids, space_ids) |
11 | | - - **API endpoints used**: |
12 | | - - `GET /list/{listId}/view` - Retrieves list views and identifies default list view |
13 | | - - `GET /view/{viewId}/task` - Retrieves all tasks associated with the view/list |
14 | | - - **Performance optimizations**: |
15 | | - - Concurrent API calls for multiple lists using `Promise.all()` |
16 | | - - Task deduplication to prevent duplicate results |
17 | | - - Automatic summary format switching for large result sets |
18 | | - - Safety limits to prevent infinite pagination loops |
19 | | - - **Robust error handling**: Graceful degradation when some lists fail, comprehensive logging |
20 | | - - **Backward compatibility**: Existing functionality unchanged when `list_ids` not provided |
21 | | - - **Impact**: Addresses ClickUp's "tasks in multiple lists" feature, providing complete task coverage for list-based queries |
22 | | - |
23 | | - Thanks @dantearaujo for the help! |
24 | | - |
25 | | -- **Added ENABLED_TOOLS configuration option (PR #39 & Issue #50)**: |
26 | | - - Added `ENABLED_TOOLS` environment variable and command line argument support |
27 | | - - Allows specifying exactly which tools should be available via comma-separated list |
28 | | - - Provides complementary functionality to existing `DISABLED_TOOLS` option |
29 | | - - **Precedence logic**: `ENABLED_TOOLS` takes precedence over `DISABLED_TOOLS` when both are specified |
30 | | - - **Configuration options**: |
31 | | - - `ENABLED_TOOLS=tool1,tool2` - Only enable specified tools |
32 | | - - `DISABLED_TOOLS=tool1,tool2` - Disable specified tools (legacy approach) |
33 | | - - If neither specified, all tools are available (default behavior) |
34 | | - - **Enhanced tool filtering**: |
35 | | - - Updated `ListToolsRequestSchema` handler to use new filtering logic |
36 | | - - Updated `CallToolRequestSchema` handler with improved error messages |
37 | | - - Clear distinction between "disabled" vs "not in enabled tools list" errors |
38 | | - - **Impact**: Users can now precisely control tool availability for security, context limitations, or workflow optimization |
39 | | - - **Backward compatibility**: Existing `DISABLED_TOOLS` functionality unchanged |
40 | | - |
41 | | - Thanks @somework & @colinmollenhour for the help! |
42 | | - |
43 | | -### 🛠️ Bug Fixes |
44 | | - |
45 | | -- **Fixed automatic priority assignment in task creation**: |
46 | | - - Fixed issue where `create_task` and `create_bulk_tasks` tools were automatically setting priorities even when users didn't specify one |
47 | | - - **Root cause**: Priority field was unconditionally included in API requests as `undefined`, which ClickUp interpreted as a request to set a default priority |
48 | | - - **Solution**: Priority field is now only included in API requests when explicitly provided by the user |
49 | | - - **Impact**: Tasks created without specifying a priority will now have `priority: null` instead of an automatically assigned priority |
50 | | - - **Affected tools**: `create_task_ClickUp__Local_` and `create_bulk_tasks_ClickUp__Local_` |
51 | | - - **Backward compatibility**: Tasks created with explicit priority values continue to work unchanged |
| 1 | +# v0.8.4 Release Notes |
| 2 | + |
| 3 | +### � Security Features |
| 4 | + |
| 5 | +- **Comprehensive MCP Streamable HTTPS Transport Security Implementation**: |
| 6 | + - **HTTPS/TLS Support**: Added optional HTTPS server alongside HTTP for encrypted communication |
| 7 | + - Environment variables: `ENABLE_HTTPS`, `SSL_KEY_PATH`, `SSL_CERT_PATH`, `SSL_CA_PATH`, `HTTPS_PORT` |
| 8 | + - Dual protocol support: HTTP (3231) and HTTPS (3443) run simultaneously for backwards compatibility |
| 9 | + - Self-signed certificate generation script: `./scripts/generate-ssl-cert.sh` |
| 10 | + - Production-ready with CA-issued certificates |
| 11 | + - **Origin Header Validation**: Prevents cross-site attacks by validating Origin header against whitelist |
| 12 | + - Environment variable: `ENABLE_ORIGIN_VALIDATION=true` |
| 13 | + - Default allowed origins: `127.0.0.1:3231`, `localhost:3231`, plus HTTPS variants |
| 14 | + - Smart handling: Allows non-browser clients (n8n, MCP Inspector) while blocking unauthorized origins |
| 15 | + - **Rate Limiting Protection**: Protects against DoS attacks with configurable request limits |
| 16 | + - Environment variable: `ENABLE_RATE_LIMIT=true` |
| 17 | + - Default: 100 requests per minute per IP address |
| 18 | + - Configurable via: `RATE_LIMIT_MAX`, `RATE_LIMIT_WINDOW_MS` |
| 19 | + - **CORS Configuration**: Secure cross-origin resource sharing for web applications |
| 20 | + - Environment variable: `ENABLE_CORS=true` |
| 21 | + - Supports GET, POST, DELETE, OPTIONS methods |
| 22 | + - Headers: Content-Type, mcp-session-id, Authorization |
| 23 | + - **Security Headers**: Web security best practices when `ENABLE_SECURITY_FEATURES=true` |
| 24 | + - X-Content-Type-Options, X-Frame-Options, X-XSS-Protection |
| 25 | + - Referrer-Policy, Strict-Transport-Security (HTTPS only) |
| 26 | + - **Request Size Limits**: Prevents memory exhaustion attacks |
| 27 | + - Configurable limit: `MAX_REQUEST_SIZE=10mb` (default) |
| 28 | + - Hard limit: 50MB maximum |
| 29 | + - **Security Monitoring**: Comprehensive logging and health endpoint |
| 30 | + - Health endpoint: `/health` shows security status |
| 31 | + - Security event logging: origin validation, rate limits, violations |
| 32 | + - Log levels: DEBUG, INFO, WARN, ERROR for security events |
| 33 | + - **Zero Breaking Changes**: All security features are opt-in and disabled by default |
| 34 | + - Existing clients (Claude Desktop, n8n, MCP Inspector) work unchanged |
| 35 | + - No configuration changes required for current users |
| 36 | + - Backwards compatibility thoroughly tested and verified |
| 37 | + |
| 38 | +### 🐛 Bug Fixes |
| 39 | + |
| 40 | +- **Fixed Gemini compatibility (Issue #79)**: |
| 41 | + - **Root cause**: Priority enum values were defined as numbers `[1, 2, 3, 4, null]` but Gemini API expects strings |
| 42 | + - **Solution**: Updated priority enum to use string values `["1", "2", "3", "4", null]` in `update_task` and `update_bulk_tasks` tools |
| 43 | + - **Schema changes**: Changed type from `"number"` to `"string"` for priority field in affected tools |
| 44 | + - **Backward compatibility**: Maintained via existing `toTaskPriority()` function that handles string-to-number conversion |
| 45 | + - **Impact**: Resolves schema validation errors in Cursor IDE and other Gemini-based MCP clients |
| 46 | + - **Affected tools**: `update_task_ClickUp__Local_` and `update_bulk_tasks_ClickUp__Local_` |
| 47 | + - **Testing**: Verified priority setting and removal functionality works correctly |
| 48 | + |
| 49 | +- **Fixed priority null handling in task updates (Issue #23)**: |
| 50 | + - Fixed `update_task` tool failing when setting priority to `null` to clear/remove priority |
| 51 | + - Modified `buildUpdateData` function to use `toTaskPriority` helper for proper null value conversion |
| 52 | + - Priority updates now work correctly for both setting valid values (1-4) and clearing priority (null) |
| 53 | + - Bulk task updates (`update_bulk_tasks`) already worked correctly and continue to function properly |
| 54 | + |
| 55 | +- **Fixed subtasks not being retrieved (Issue #69)**: |
| 56 | + - Fixed `getSubtasks` method in `task-core.ts` to include required query parameters |
| 57 | + - Added `subtasks=true` and `include_subtasks=true` parameters to ClickUp API call |
| 58 | + - Subtasks are now properly retrieved and displayed when using `get_task` tool with `subtasks=true` |
| 59 | + - Resolves issue where subtasks arrays were always empty despite subtasks existing in ClickUp |
| 60 | + |
| 61 | +### 🔧 Compatibility Improvements |
| 62 | + |
| 63 | +- **Enhanced MCP Client Support**: Improved compatibility with Cursor IDE and Gemini-based MCP clients |
| 64 | +- **Schema Standardization**: Aligned tool schemas with MCP protocol best practices for broader client support |
| 65 | +- **Testing Coverage**: Verified functionality across multiple MCP client implementations |
0 commit comments