---
summary: "mcp-ts-core ^0.10.6 → ^0.10.9 — ctx.content media collector, two new devcheck guards (dependency specifiers, plugin marketplace manifests), sharper canvas SQL error classification; @duckdb/node-api and @types/node bumps; eight skills re-synced"
breaking: false
security: false
---

# 0.7.6 — 2026-06-20

## Added

- **`check-dependency-specifiers` devcheck step** — re-synced `scripts/check-dependency-specifiers.ts` (registered in `ALL_CHECKS`, flag `--no-dep-specifiers`) hard-fails on floating specifiers (`latest`, `*`, pre-release dist-tags) in `package.json` dependency sections and `bun.lock`'s `workspaces` map. Catches a `bun update --latest` writing a `latest` dist-tag into the lock that would let the next `bun install` re-resolve past an intentional hold. ([cyanheads/mcp-ts-core#246](https://github.com/cyanheads/mcp-ts-core/issues/246))
- **Plugin marketplace manifest checks** — `lint:packaging` gains a check validating `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json` (+ `.codex-plugin/mcp.json`): non-empty descriptions, unscoped machine name in display fields, and the full `package.json` name in the `npx -y` install arg. Enabled by the new `devcheck.config.json` `packaging.pluginManifests: true` flag. ([cyanheads/mcp-ts-core#240](https://github.com/cyanheads/mcp-ts-core/issues/240))

## Changed

- **`@cyanheads/mcp-ts-core`** `^0.10.6` → `^0.10.9`. Picks up: `ctx.content` — an always-present collector for image/audio content blocks that ride `content[]` only (never `structuredContent`); canvas SQL gate now classifies a `SELECT`-shaped statement that fails to prepare (bad column, unknown function) as `ValidationError` `data.reason: 'invalid_sql'` with the DuckDB binder detail, instead of the misleading `non_select_statement`; corrected `OTEL_SERVICE_NAME` seeding docs (`createApp({ name })` seeds it only when unset). ([cyanheads/mcp-ts-core#239](https://github.com/cyanheads/mcp-ts-core/issues/239), [#236](https://github.com/cyanheads/mcp-ts-core/issues/236), [#233](https://github.com/cyanheads/mcp-ts-core/issues/233))
- **`.codex-plugin/plugin.json`** — filled the empty `interface.longDescription` so the Codex marketplace manifest passes the new packaging check.
- **Eight `skills/<name>/SKILL.md` re-synced** from the framework — `add-tool` 2.14→2.15, `api-canvas` 1.6→1.7, `api-config` 1.7→1.8, `api-context` 1.8→1.9, `api-telemetry` 1.1→1.2, `git-wrapup` 1.2→1.4, `orchestrations` 1.3→1.4, `polish-docs-meta` 2.7→2.9 — mirrored into `.claude/skills/` and `.agents/skills/`.

## Dependencies

- **`@cyanheads/mcp-ts-core`** `^0.10.6` → `^0.10.9`
- **`@duckdb/node-api`** `^1.5.3-r.3` → `^1.5.4-r.1` (the bump deferred from 0.7.5 — now inside the caret)
- **`@types/node`** `^25.9.3` → `^26.0.0`