---
summary: "Search tools correct session, jurisdiction, and name-length error handling; org_classification=legislature now resolves via a chamber union; adds a created_since bill filter. Adopts mcp-ts-core ^0.10.14 with a new supply-chain guard."
breaking: false
security: false
---

# 0.1.11 — 2026-07-16

## Added

- **`created_since`** — new ISO 8601 date filter on `openstates_search_bills`, parallel to `action_since`/`updated_since`; finds newly-introduced bills rather than recently-updated or recently-acted-on ones. ([#16](https://github.com/cyanheads/openstates-mcp-server/issues/16))
- **Supply-chain guard** — `bunfig.toml` blocks installing package versions published in the last 3 days (`minimumReleaseAge`, exempting `@cyanheads/mcp-ts-core` for same-day framework adoption) and wires in `@socketsecurity/bun-security-scanner` to scan every install.
- **`.gitattributes`**, **`.github/FUNDING.yml`**, **`.github/SECURITY.md`** — line-ending normalization, binary-asset handling, linguist exclusions for generated files, funding links, and a vulnerability-reporting policy.

## Changed

- **`openstates_search_people`** — `org_classification=legislature` (accepted by the upstream enum but never any person's actual role) now resolves server-side to the `upper` + `lower` chamber union instead of returning an empty set; omitting the filter is documented as not equivalent to `legislature` (it includes `executive`). ([#22](https://github.com/cyanheads/openstates-mcp-server/issues/22))
- **Dockerfile** — pinned `oven/bun` 1.3 → 1.3.14, added BuildKit cache mounts to every `bun install` step, and `--ignore-scripts` on the build stage.
- **Vendored skills resynced** to mcp-ts-core `^0.10.14` — annotated tags use `--cleanup=whitespace` and a changelog-link footer, GHCR verification via `docker manifest inspect`, the changelog `security:` flag documented as source-fix-only (dependency CVE bumps record under `## Dependencies` instead), a new `api-linter` `definition-invalid` rule, and a `design-mcp-server` reference-tool pattern.

## Fixed

- **`openstates_search_bills`** — a `session`-filtered empty result no longer throws `invalid_session`. The API returns `200 total_items: 0` for both an unrecognized session and a legitimately narrow query with no way to tell them apart, so it now falls through to the empty-result notice, with `session` echoed in the filters and a pointer to `openstates_get_jurisdiction`. ([#13](https://github.com/cyanheads/openstates-mcp-server/issues/13))
- **`openstates_search_people`** — removed the `name_too_short` error contract. The API enforces no minimum name length, so upstream errors now bubble unchanged instead of being remapped. ([#15](https://github.com/cyanheads/openstates-mcp-server/issues/15))
- **`openstates_search_events`** — now throws `jurisdiction_required` instead of running a silent all-states search. The endpoint has no all-states search and rejects an omitted `jurisdiction` with `400`. ([#14](https://github.com/cyanheads/openstates-mcp-server/issues/14))
- **`openstates_search_committees`** — `.describe()` corrected: omitting `jurisdiction` returns `200 total_items: 0`, not an all-states search. ([#14](https://github.com/cyanheads/openstates-mcp-server/issues/14))

## Dependencies

- `@cyanheads/mcp-ts-core` ^0.10.9 → ^0.10.14
- `@biomejs/biome` ^2.5.0 → 2.5.2 (pinned exact)
- `@types/node` ^26.0.0 → ^26.1.1
- `ignore` ^7.0.5 → ^7.0.6
- `tsc-alias` ^1.8.17 → ^1.9.0
- `vitest` ^4.1.9 → ^4.1.10
- Transitive `js-yaml` 3.14.2 → 3.15.0, clearing [GHSA-h67p-54hq-rp68](https://github.com/advisories/GHSA-h67p-54hq-rp68) (moderate)