---
summary: "Local minchargepoints enforcement and zero-coordinate filtering in find_stations; tightened tool/resource descriptions; dependency bump clears a moderate js-yaml DoS advisory"
breaking: false
security: true
---

# 0.1.4 — 2026-07-04

## Changed

- **Tool/resource descriptions** — tightened client-facing text across `find-stations`, `get-station`, `get-station-comments`, `lookup-reference`, `_station-schema.ts`, and `station.resource.ts`: cut caller-coaching phrasing ("Obtain a station ID from…", "Pass to…", "Use the returned id(s) in…") and implementation leaks ("Server-computed…", "the OCM API", "handler trims", "the resource twin of…"). (#3)

### Dependency bumps

- `@cyanheads/mcp-ts-core` ^0.10.9 → ^0.10.10
- `@biomejs/biome` 2.5.0 → ^2.5.2
- `@types/node` 26.0.0 → ^26.1.0
- `tsc-alias` ^1.8.17 → ^1.9.0

## Fixed

- **`openchargemap_find_stations` `minchargepoints`** — now enforced locally; OCM's `minnumberofpoints` query parameter has no effect on live results. Station charge-point count resolves from `numberOfPoints` when present, falling back to summed connection quantities (OCM omits `numberOfPoints` on ~96% of records); a station with no count signal at all is kept as unknown rather than excluded. (#1)
- **Zero-coordinate (`0,0`) and missing-coordinate POIs** — `openchargemap_find_stations` now drops these from radius and bounding-box search results before they can surface as false zero-distance matches, a systemic OCM data-quality pattern rather than an isolated case. Direct lookups (`openchargemap_get_station`, `openchargemap_get_station_comments`, the `openchargemap://station/{id}` resource) still return `0,0` records as-is but now flag the bad coordinate in `reliabilityNote`. (#2)

## Security

- **`js-yaml`** — the `@cyanheads/mcp-ts-core` bump forced a lockfile re-resolution that moved the transitive `depcheck` → `js-yaml` dependency from `3.14.2` to `3.15.0`, clearing [GHSA-h67p-54hq-rp68](https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68) (CVE-2026-53550), a moderate quadratic-complexity DoS in merge-key (`<<`) handling via repeated aliases. `bun audit`: 1 moderate → 0.