---
summary: "Framework 0.8.14 → 0.8.20, engines bumped to Bun ≥1.3 / Node ≥24, search/count format() renders array criteria as [a, b], fuzz coverage for 3 tools, new api-telemetry skill, template-fork dep cleanup."
breaking: false
security: false
---

# 2.4.7 — 2026-05-10

Maintenance release. Framework catch-up across six minor versions, runtime floor bumped, plus a small format()-output fix for array-valued search criteria.

## Added

- **`api-telemetry` skill** — OTel catalog reference for the framework: spans, metrics, completion logs, env config, runtime caveats, custom instrumentation patterns, cardinality rules. Synced from upstream (v1.0); referenced in `CLAUDE.md` / `AGENTS.md` skills table.
- **Fuzz tests** — `searchStudies`, `findEligible`, `getFieldDefinitions` now exercised with 50 valid + 30 adversarial inputs each via `fuzzTool` from `@cyanheads/mcp-ts-core/testing/fuzz`. Asserts no programmer crashes (non-`McpError` throws), no leaks, no prototype pollution. Run via `bun run test:fuzz`.
- **`changelog/template.md` `security:` frontmatter flag** — pristine reference resynced from upstream; new `security: true` flag pairs with a `## Security` section and renders a `🛡️ Security` badge in the rollup. `scripts/build-changelog.ts` extended to parse and render it.

## Changed

- **`@cyanheads/mcp-ts-core` 0.8.14 → 0.8.20** — six framework releases rolled up:
  - 0.8.15 — `spillover()` helper exported from `/canvas` for source-agnostic preview/spill of large tabular results.
  - 0.8.16 — HTTP SSE per-request retention leak fixed; `closePerRequestInstances` now bound to the request `AbortSignal`.
  - 0.8.17 — `ctx.sessionId` surfaced on `Context` for HTTP handlers; fail-closed under stateless mode with `createApp({ context: { exposeStatelessSessionId } })` opt-in.
  - 0.8.18 — `ctx.auth.token` strip fixed in `toAuthContext`; typed `token?: string` on `AuthContext` so handlers can relay the bearer upstream.
  - 0.8.19 — telemetry visualization docs (Grafana dashboard JSON, vendor-agnostic query recipes), `api-telemetry` skill added, engines bumped to Bun ≥1.3.0 / Node ≥24.0.0.
  - 0.8.20 — `mcp_tool_scopes` claim union + `MCP_AUTH_DISABLE_SCOPE_CHECKS` bypass for OIDC providers that can't inject scopes into `scope`.
- **Engines bumped** — `bun ≥1.2.0` → `≥1.3.0`, `node ≥22.0.0` → `≥24.0.0` (carried from framework 0.8.19). README prerequisite updated.
- **Dockerfile base images** — `oven/bun:1` / `oven/bun:1-slim` → `oven/bun:1.3` / `oven/bun:1.3-slim`. Pins to the engine floor instead of latest 1.x.
- **Skills resynced from framework** — `add-tool` 2.7 → 2.8 (spillover note in payload size guidance), `api-auth` 1.0 → 1.1 (claim union, bypass flag, tenantId table), `api-canvas` 1.1 → 1.2 (spillover pattern), `api-config` 1.3 → 1.4 (`MCP_AUTH_DISABLE_SCOPE_CHECKS`), `api-context` 1.2 → 1.3 (`ctx.sessionId`), `api-utils` 2.1 → 2.2 (`httpErrorFromResponse`, `httpStatusToErrorCode`, `ErrorHandler.classifyOnly`), `design-mcp-server` 2.9 → 2.10 (spillover guidance), `maintenance` 2.0 → 2.1 (Phase C now syncs pristine reference files), `report-issue-framework` 1.5 → 1.6 (Bun 1.3.x), `report-issue-local` 1.4 → 1.5 (Bun 1.3.x), `security-pass` 1.3 → 1.4 (`MCP_AUTH_DISABLE_SCOPE_CHECKS` audit axis), `setup` 1.6 → 1.7 (`bunx` over `npx`, `release-and-publish` in Next Steps), `tool-defs-analysis` 1.0 → 1.1 (env-var smell list trimmed).
- **`devcheck.config.json` ignores** — added `fast-check` (new dev dep), removed `pino` (no longer a direct dep) and `repomix` (no longer used).
- **`@biomejs/biome` ^2.4.14 → ^2.4.15`, `@cloudflare/workers-types` ^4.20260505.1 → ^4.20260510.1`, `@types/node` ^25.6.0 → ^25.6.2`, `vite` ^8.0.10 → ^8.0.11`** (devDeps).

## Fixed

- **`clinicaltrials_search_studies` and `clinicaltrials_get_study_count` `format()`** — array-valued criteria now render as `key=[val1, val2]` instead of relying on JS's implicit `Array#toString()` (`key=val1,val2`), which was indistinguishable from a single comma-containing value. Applies to repeated query/filter inputs like `phase`, `studyType`, `status`.

## Removed

- **`pino` direct dep** — now brought in transitively via `@cyanheads/mcp-ts-core`. `pino-pretty` retained as a direct dep for development log formatting.
- **Stale `mcp-ts-template` carryovers** — `@types/diff`, `@types/js-yaml`, `@types/node-cron`, `@types/papaparse`, `@types/sanitize-html`, `@types/validator`, `diff`, `repomix`. Unused since the framework split; depcheck confirmed none are imported.