---
summary: "Adopt @cyanheads/mcp-ts-core ^0.10.9 — clearer bls_dataframe_query SQL-gate errors, qualified DataCanvas describe() filters, and two new devcheck gates (floating dependency specifiers, plugin-manifest correctness). Dependency refresh; codex plugin longDescription filled."
breaking: false
security: false
---

# 0.4.6 — 2026-06-20

## Added

- **`check-dependency-specifiers` devcheck gate** — adopted from the framework: hard-fails on floating specifiers (`latest`, `*`, pre-release dist-tags) in `package.json`'s dependency sections and `bun.lock`'s `workspaces` map, catching the case where `bun update --latest` writes a literal `latest` into the lock and lets the next install re-resolve past the pinned range.
- **Plugin-manifest checks in `lint:packaging`** — the framework's `lint:packaging` now validates `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and `.codex-plugin/mcp.json` for non-empty descriptions, unscoped display identity, and a full-name install arg; enabled via the new `devcheck.config.json` `packaging.pluginManifests: true`.

## Changed

- **`@cyanheads/mcp-ts-core` `^0.10.6` → `^0.10.9`** — picks up:
  - **Canvas SQL-gate classification** — a `SELECT`-shaped `bls_dataframe_query` statement that parses but fails to prepare (mistyped column, unknown function) now throws `ValidationError` with `data.reason: 'invalid_sql'` and the DuckDB binder detail in `data.binderMessage`, instead of the misleading `non_select_statement`.
  - **`DuckdbProvider.describe()` filter fix** — qualified the pushed `WHERE` filters with the table alias, fixing an ambiguous-column Binder Error on every filtered `bls_dataframe_describe({ tableName })`.
  - **`ctx.content`** — new always-present collector for image/audio content blocks that ride `content[]` only and never duplicate into `structuredContent`.
  - Fresh-scaffold devcheck guards, biome 2.5, and a framework dependency refresh (`hono`, `@hono/node-server`, and the bundled toolchain).
- **`.codex-plugin/plugin.json` `interface.longDescription`** — filled the previously empty field with the server's workflow summary (SeriesID resolution via `bls_search_series`, history/latest tools, DataCanvas spillover, quota tiers).
- Re-synced eight bundled skills and the devcheck script set to their `^0.10.9` framework versions.

### Dependency bumps

- `@cyanheads/mcp-ts-core` `^0.10.6` → `^0.10.9`
- `@duckdb/node-api` `^1.5.3-r.3` → `^1.5.4-r.1`
- `@types/node` `^25.9.3` → `^26.0.0`