diff --git a/CHANGELOG.md b/CHANGELOG.md index 861ea42..e4611d3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,7 @@ ## Unreleased +## 0.8.2 - 2026-07-30 + ### Fixed - **Tracing**: Access tokens are no longer included in exported spans. Mapbox APIs take the access token as a URL query parameter, and OpenTelemetry's HTTP/undici auto-instrumentation records the full request URL on client spans (`url.full`, `url.query`), so operators who configured `OTEL_EXPORTER_OTLP_ENDPOINT` had tokens copied verbatim into their telemetry backend. The OTLP exporter is now wrapped in a `RedactingSpanExporter` that strips the token signature from all string span attributes before export. Redaction keeps the token prefix and account name — `pk.eyJ1...xyz.signature` becomes `pk.your-account.redacted` — so spans still distinguish public from secret tokens and show which account a request billed to, without carrying a usable credential. Values that do not parse as a Mapbox token fall back to `access_token=***`. diff --git a/manifest.json b/manifest.json index 764d982..946e62d 100644 --- a/manifest.json +++ b/manifest.json @@ -2,7 +2,7 @@ "dxt_version": "0.1", "name": "@mapbox/mcp-devkit-server", "display_name": "Mapbox MCP DevKit Server", - "version": "0.8.1", + "version": "0.8.2", "description": "Mapbox MCP devkit server", "author": { "name": "Mapbox, Inc." diff --git a/package-lock.json b/package-lock.json index 128563c..da22bb9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@mapbox/mcp-devkit-server", - "version": "0.8.1", + "version": "0.8.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@mapbox/mcp-devkit-server", - "version": "0.8.1", + "version": "0.8.2", "hasInstallScript": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index bbab8d9..f4974e0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@mapbox/mcp-devkit-server", - "version": "0.8.1", + "version": "0.8.2", "description": "Mapbox MCP devkit server", "mcpName": "io.github.mapbox/mcp-devkit-server", "main": "./dist/commonjs/index.js", diff --git a/server.json b/server.json index 579da30..02c1994 100644 --- a/server.json +++ b/server.json @@ -6,13 +6,13 @@ "url": "https://github.com/mapbox/mcp-devkit-server", "source": "github" }, - "version": "0.8.1", + "version": "0.8.2", "packages": [ { "registryType": "npm", "registryBaseUrl": "https://registry.npmjs.org", "runtimeHint": "npx", - "version": "0.8.1", + "version": "0.8.2", "identifier": "@mapbox/mcp-devkit-server", "transport": { "type": "stdio"