---
summary: "mcp-ts-core ^0.13.0 adoption: a cancelled request returns RequestCancelled (-32011) instead of the raw abort error, and the development skill tree moves to framework-skills/ so a plugin install no longer receives it."
breaking: false
security: false
---

# 0.3.12 — 2026-09-13

## Added

- **`bun run audit:fix`** runs `bun audit fix`, upgrading vulnerable dependencies inside their declared ranges; `audit:refresh` stays the last resort ([mcp-ts-core 0.13.0](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.0.md)).

## Changed

- **A cancelled request now raises `RequestCancelled` (-32011)** — `CrossrefService` classifies an aborted `ctx.signal` through `requestCancelled()` rather than returning the caller's own abort error. The code is a framework baseline, so no tool declares it ([mcp-ts-core 0.12.4](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.12.x/0.12.4.md)).
- **An argument rejection comes back as `InvalidParams` (-32602)** in the structured error envelope, where it was `ValidationError` before ([mcp-ts-core 0.12.7](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.12.x/0.12.7.md)). A direct handler call through `runToolContract` still validates in-process and reports `ValidationError`.
- **The `CROSSREF_MAILTO` startup warning goes through `logger.warning`** instead of `console.warn` — `setup()` records are buffered and replayed once the logger initializes, so a pre-init warning is no longer dropped ([mcp-ts-core 0.12.5](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.12.x/0.12.5.md)).
- **`ServerConfigSchema.mailto` drops its `z.preprocess` placeholder guard** — `parseEnvConfig` reads an empty string and a whole-value `${…}` placeholder as unset, so a blank bundle field resolves to `undefined` without a local strip ([mcp-ts-core 0.13.0](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.0.md)).
- **The development skill tree moved from `skills/` to `framework-skills/`** — Claude Code and Codex auto-load a plugin's root `skills/`, so this server's development skills were reaching every agent that installed it. `.mcpbignore`, `.github/CONTRIBUTING.md`, `CLAUDE.md`/`AGENTS.md`, and `docs/tree.md` follow the path; the `.claude/` and `.agents/` mirrors keep their names.
- **`CROSSREF_MAILTO` is collected through `user_config` in both plugin manifests** — `manifest.json` and `.claude-plugin/plugin.json` reference `${user_config.CROSSREF_MAILTO}`, and `.codex-plugin/mcp.json` forwards the host variable via `env_vars` instead of an empty `env` entry that would shadow an exported value.
- **`MCP_SESSION_MODE=stateless` is pinned in `.env.example`** and documented in the README config table; the framework schema default is `auto`, which resolves to `stateful`.
- **Bun engines floor raised to `>=1.4.0`**, matching the framework ([mcp-ts-core 0.12.9](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.12.x/0.12.9.md)).
- Repo and tooling metadata: issue forms auto-assign and accept blank issues, the bug form routes server-vs-framework reports and links the private security advisory form, the README drops its invitation for pull requests, the `devcheck` outdated and skill-version allowlists are emptied, and `tests/config/server-config.test.ts` covers the env boundary alongside a 501 non-retryable regression case.

## Dependencies

- `@cyanheads/mcp-ts-core` `^0.12.3` → `^0.13.0`
- `zod` `^4.4.3` → `^4.6.1`
- `vitest` (dev) `^4.1.11` → `^5.0.0`
- `@biomejs/biome` (dev) `^2.5.10` → `^2.5.13`
- `@types/node` (dev) `^26.2.0` → `^26.5.1`
- `ignore` (dev) `^7.0.5` → `^7.0.9`
- `tsc-alias` (dev) `^1.9.2` → `^1.9.4`

441 tests pass; `bun run devcheck` and `bun run rebuild` clean.