---
summary: "nws_search_alerts checks a zone's area prefix and rejects blank/empty filters instead of widening to a national search; nws_get_observations rejects a blank station_id instead of silently answering from coordinates"
breaking: false
security: false
---

# 0.7.3 — 2026-08-12

## Fixed

- **`nws_search_alerts` zone validation** — a zone's 2-letter prefix is checked against the NWS area-code set, so a well-formed-but-fake zone like `QQZ123` fails locally as `invalid_zone` instead of leaking NWS's raw parameter regex; a real prefix with no matching zone (`WAZ999`) still passes through to a clean empty result. ([#20](https://github.com/cyanheads/nws-weather-mcp-server/issues/20))
- **`nws_search_alerts` blank/empty filters** — a blank `area`/`point`/`zone`, or an `event`/`severity`/`urgency`/`certainty` array with no non-blank entries, is now rejected (`blank_location_filter`/`empty_filter_array`) instead of silently collapsing to a wider search. ([#30](https://github.com/cyanheads/nws-weather-mcp-server/issues/30))
- **`nws_get_observations` blank `station_id`** — a whitespace-only `station_id` is now rejected as `blank_station_id` instead of silently falling back to the nearest station by coordinates. ([#34](https://github.com/cyanheads/nws-weather-mcp-server/issues/34))

## Changed

- **Docker image** — production install adds `--omit=peer` (and `--omit=dev --omit=peer` for the OpenTelemetry install), dropping optional framework peer tiers Bun would otherwise auto-install; base image pinned to `oven/bun:1.3.14`.

## Dependencies

- `@cyanheads/mcp-ts-core` `^0.10.10 → ^0.11.5`
- `typescript` `^6.0.3 → ^7.0.2`
- `@biomejs/biome` `^2.5.2 → ^2.5.7`
- `vitest`, `@vitest/coverage-istanbul` `^4.1.9 → ^4.1.10`
- `@types/node` `^26.1.0 → ^26.2.0`
- `tsc-alias` `^1.8.17 → ^1.9.1`
- `ignore` `^7.0.5 → ^7.0.6`
- added `@socketsecurity/bun-security-scanner` `^1.1.2`, wired as `bunfig.toml`'s install-time scanner