---
summary: "Cleared 6 transitive advisories in fast-uri and qs via overrides; adopted mcp-ts-core's retried upstream 500s and cancellation classification"
breaking: false
security: true
---

# 0.5.15 — 2026-09-04

## Changed

- **An upstream Hacker News 500 now retries before the call fails**, where it previously failed on the first attempt — `@cyanheads/mcp-ts-core` 0.12.4 moved 500 into the transient retry set.
- **A caller that disconnects mid-call is now reported as a cancellation** rather than an internal server error.
- Shipped skills: `add-tool` 2.21, `api-config` 1.15, `api-context` 2.2, `api-errors` 1.8, `api-linter` 1.13, `api-utils` 2.8, `design-mcp-server` 2.23, `maintenance` 2.6, `release-and-publish` 2.13, `setup` 1.10.

## Fixed

- **`HnService.fetchItems` rethrows a caller cancellation** instead of absorbing it as a per-item failure — a batch item fetch now stops when the caller cancels, instead of spending the rest of the id list on fetches nobody is waiting for.

## Security

- **`fast-uri` and `qs` pinned via a new `overrides` block** to `^3.1.6` and `^6.16.0` — clears 6 advisories `bun audit` reported through the framework's MCP SDK dependency (4 high in `fast-uri@3.1.5`: SSRF and host confusion; 2 moderate in `qs@6.15.3`). `bun audit` now reports no vulnerabilities across 372 packages.

## Dependencies

- `@cyanheads/mcp-ts-core` `^0.12.3` → `^0.12.5`
- `zod` `^4.4.3` → `^4.5.4`
- `@biomejs/biome` `^2.5.10` → `^2.5.11`
- `@types/node` `^26.2.0` → `^26.4.0`
- `ignore` `^7.0.6` → `^7.0.8`
- `tsc-alias` `^1.9.2` → `^1.9.3`