---
summary: "Survey-catalog corrections: bls_list_surveys category map (#44), catalog harvest sa→ap Average Price fix (#43), and one canonical survey list shared by the catalog and observations ingester (#49). Adopts mcp-ts-core ^0.10.14 supply-chain hardening (minimumReleaseAge, Socket scanner, SECURITY.md); Bun 1.3.14; dependency refresh."
breaking: false
security: false
---

# 0.4.7 — 2026-07-17

## Added

- **Supply-chain hardening** — `bunfig.toml` gains `minimumReleaseAge` (blocks installing package versions published within the last 3 days, excluding same-day `@cyanheads/mcp-ts-core` releases) and a Socket security scanner (`@socketsecurity/bun-security-scanner`) that screens every install for malware, typosquats, and known CVEs. The `devcheck` `outdated` gate now skips packages held back purely by `minimumReleaseAge` (installable target equals current version, flagged `*`) instead of failing on them.
- **`.github/SECURITY.md`** — vulnerability reporting policy (GitHub private reporting or `casey@caseyjhand.com`).
- **`.github/FUNDING.yml`** — GitHub Sponsors and Buy Me a Coffee funding links.
- **`.gitattributes`** — normalizes line endings to LF, marks binary asset extensions, and collapses `bun.lock`/`CHANGELOG.md`/`docs/tree.md` as generated in PR diffs and language stats.

## Changed

- **`@cyanheads/mcp-ts-core` `^0.10.9` → `^0.10.14`** — brings the supply-chain hardening pattern above, plus routine framework fixes and a dependency refresh.
- **Bun `1.3.2` → `1.3.14`** — `packageManager` field; Dockerfile base images `oven/bun:1.3` → `oven/bun:1.3.14` and `oven/bun:1.3-slim` → `oven/bun:1.3.14-slim`.
- **Dockerfile** — `bun install` steps use a BuildKit cache mount (`--mount=type=cache,target=/root/.bun/install/cache`) to persist Bun's package cache across builds.
- **`package.json` `author` / `LICENSE` copyright** — normalized to `Casey Hand <casey@caseyjhand.com>` / `Copyright 2026 Casey Hand @cyanheads`.
- **`devcheck.config.json`** — `@socketsecurity/bun-security-scanner` added to the `depcheck` ignore list (config-only dependency, no import); `typescript` added to the `outdated` allowlist (TypeScript 7 is out; holding `^6.0.3` pending a deliberate migration).
- Re-synced 12 bundled skills to their `^0.10.14` framework versions.

### Dependency bumps

- `@cyanheads/mcp-ts-core` `^0.10.9` → `^0.10.14`
- `@biomejs/biome` `^2.5.0` → `^2.5.2`
- `@types/node` `^26.0.0` → `^26.1.0`
- `ignore` `^7.0.5` → `^7.0.6`
- `tsc-alias` `^1.8.17` → `^1.9.0`
- `vitest` `^4.1.9` → `^4.1.10`
- New: `@socketsecurity/bun-security-scanner` `^1.1.2`

## Fixed

- **`bls_list_surveys` `CATEGORY_MAP`** — `injuries` no longer returns `IN` (International Labor Comparison); populated with the real injury/illness family (`CA`, `CB`, `CD`, `CF`, `CH`, `CS`, `FA`, `FI`, `FW`, `HC`, `HS`, `II`, `IS`, `SH`, `SI`). `employment` drops the phantom `IC`; `productivity` drops the phantom `DI` and adds `PI`/`PF`. ([#44](https://github.com/cyanheads/bls-labor-mcp-server/issues/44))
- **`bls-catalog` harvest survey `sa` → `ap`** — the catalog harvested the discontinued SIC employment survey (`sa`) under the label "CPI - Average Retail Prices," leaving the real BLS Average Price Data survey (`ap` — `APU…` gasoline/eggs/electricity dollar prices) unindexed and unsearchable. Corrected `abbr` to `ap` and `name` to "Consumer Price Index - Average Price Data". ([#43](https://github.com/cyanheads/bls-labor-mcp-server/issues/43))
- **Observations ingester survey list drift** — `bls-observations/ingester.ts` kept its own hand-maintained survey list that had diverged from the catalog's (still `sa`, not `ap`). Removed; the ingester now imports the catalog's new `SURVEY_ABBRS` export, so a survey correction in one place reaches both harvests. ([#49](https://github.com/cyanheads/bls-labor-mcp-server/issues/49))