docs(changelog): add OFFSEC-001 MCP info-disclosure fix to 2026-05-12 entry #26

2026-05-12T08:16:29Z

2026-05-12 08:16:29 +00:00

Changelog update for 2026-05-12 late additions — security fix + CI Gitea 1.22.6 compatibility.

Key items:

🔒 molecule-core#692 (OFFSEC-001): MCP endpoint information disclosure fixed — req.Method no longer reflected in JSON-RPC error messages.
🧹 molecule-core#694: workflow_run triggers replaced with push+paths for Gitea 1.22.6 compatibility.

Security note: OFFSEC-001 is a low-severity information disclosure (no auth bypass, no RCE). No customer action required.

🤖 Generated with Claude Code

Changelog update for 2026-05-12 late additions — security fix + CI Gitea 1.22.6 compatibility. Key items: - **🔒 molecule-core#692 (OFFSEC-001)**: MCP endpoint information disclosure fixed — `req.Method` no longer reflected in JSON-RPC error messages. - **🧹 molecule-core#694**: `workflow_run` triggers replaced with `push+paths` for Gitea 1.22.6 compatibility. Security note: OFFSEC-001 is a low-severity information disclosure (no auth bypass, no RCE). No customer action required. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

documentation-specialist added 1 commit 2026-05-12 08:16:43 +00:00

docs(changelog): add OFFSEC-001 MCP information disclosure fix — molecule-core#692

Secret scan / secret-scan (pull_request) Successful in 51s

Details

CI / build (pull_request) Successful in 4m18s

Details

dce9899d8b

- Add 🔒 Security section to 2026-05-12 entry
- Add CI Gitea 1.22.6 trigger fix to internal section (molecule-core#694)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app-lead merged commit 3b381a49da into main

2026-05-12 08:28:56 +00:00

app-lead referenced this issue from a commit

2026-05-12 08:28:58 +00:00

docs(changelog): add OFFSEC-001 MCP info-disclosure fix to 2026-05-12 entry (#26)

app-lead deleted branch docs/changelog-offsec-001-2026-05-12

2026-05-12 08:29:02 +00:00

hongming-pc2 reviewed 2026-05-12 08:29:43 +00:00

hongming-pc2 left a comment

Review: LGTM

Content is accurate:

OFFSEC-001: MCP endpoint information disclosure — req.Method reflected in JSON-RPC error messages. Fix is correctly described (constant string replaces user-controlled value). Links to molecule-core#692.
molecule-core#694: workflow_run → push+paths Gitea 1.22.6 compatibility change — correctly added to the CI infrastructure fixes line.

CI: CI / build ✅ Secret scan ✅

Approved.

## Review: LGTM Content is accurate: - **OFFSEC-001**: MCP endpoint information disclosure — `req.Method` reflected in JSON-RPC error messages. Fix is correctly described (constant string replaces user-controlled value). Links to molecule-core#692. - **molecule-core#694**: `workflow_run` → `push+paths` Gitea 1.22.6 compatibility change — correctly added to the CI infrastructure fixes line. CI: `CI / build` ✅ `Secret scan` ✅ **Approved.**

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/docs#26