---
summary: "Field-specific search-works query params (title/author/container-title/bibliographic); journal and funder works sorted most-recent-first; README/design.md accuracy fixes; mcp-ts-core ^0.10.14 with Socket install-scanning and Docker build hardening"
breaking: false
security: false
---

# 0.1.17 — 2026-07-13

## Added

- **`crossref_search_works` field-specific query params** — `queryTitle`, `queryAuthor`, `queryContainerTitle`, and `queryBibliographic` map to Crossref's `query.<field>` parameters and combine with each other and with the generic `query` for precise citation matching ([#28](https://github.com/cyanheads/crossref-mcp-server/issues/28)).
- **Supply-chain install guard** — `bunfig.toml` gains `minimumReleaseAge` (3-day hold on freshly published package versions, `@cyanheads/mcp-ts-core` excluded for same-day framework adoption) and the `@socketsecurity/bun-security-scanner` install scanner; new `.github/SECURITY.md`, `.github/FUNDING.yml`, and `.gitattributes`.

## Changed

- **`@cyanheads/mcp-ts-core` ^0.10.9 → ^0.10.14** — Docker build stage now installs with `--ignore-scripts` (matches the production stage; a dependency's native postinstall no longer aborts the build) plus BuildKit cache mounts for the install cache; `devcheck`'s Outdated gate skips versions held back by `minimumReleaseAge` instead of failing on them; `packageManager` bun@1.3.11 → bun@1.3.14, Dockerfile base image pinned to `oven/bun:1.3.14`.
- **Re-synced 12 `skills/<name>/SKILL.md`** to their upstream framework versions, mirrored into `.claude/skills/` and `.agents/skills/`: `add-tool`, `api-canvas`, `api-linter`, `api-utils`, `api-workers`, `code-simplifier`, `design-mcp-server`, `git-wrapup`, `orchestrations`, `polish-docs-meta`, `release-and-publish`, `techniques`.

## Fixed

- **`crossref_search_journals` / `crossref_search_funders` recency** — `getJournalWorks()` and `getFunderWorks()` now request `sort=published&order=desc`; both previously returned Crossref's arbitrary default ordering despite the tool description and README calling the results "most recent" ([#27](https://github.com/cyanheads/crossref-mcp-server/issues/27)).
- **README / `docs/design.md` accuracy** — deep-paging cursor token corrected from `next-cursor` to `nextCursor` (matches the actual `crossref_search_works` output field); journal "DOI prefix" corrected to "total DOI count" (matches the `totalDois` field) ([#30](https://github.com/cyanheads/crossref-mcp-server/issues/30)).

## Dependencies

- `@cyanheads/mcp-ts-core` ^0.10.9 → ^0.10.14
- `js-yaml` 3.14.2 → 3.15.0 (transitive, clears [GHSA-h67p-54hq-rp68](https://github.com/advisories/GHSA-h67p-54hq-rp68))
- new devDependency: `@socketsecurity/bun-security-scanner` ^1.1.2