---
summary: "Security: fetchWithTimeout redacts query-string secrets; error-contract lint scoped to throw sites; list-changed notifications routed via request scope under HTTP"
breaking: false
security: true
---

# 0.9.20 — 2026-06-01

## Fixed

- **`fetchWithTimeout` query-string secret redaction.** All thrown `McpError` messages and logger calls in `fetchWithTimeout` now use `origin + pathname` only — the query string (e.g. `?api-key=…`, `?api_key=…`) is stripped before any error message or log line is written. Covers all 11 sites across the `currentUrl` and `operationDescription` forms, including three client-facing throws (non-OK response, timeout, network error). Closes [#190](https://github.com/cyanheads/mcp-ts-core/issues/190).
- **`error-contract` lint scoped to construction sites.** `lintErrorContractConformance` (rules `error-contract-conformance` and `error-contract-prefer-fail`) now counts only `new McpError(JsonRpcErrorCode.X, …)` at throw position — comparisons (`=== JsonRpcErrorCode.X`) and `case` labels no longer populate the observed set, eliminating false-positive warnings on catch-and-reroute handlers. Closes [#191](https://github.com/cyanheads/mcp-ts-core/issues/191).
- **List-changed / resource-updated notifications under HTTP.** `notifyToolListChanged`, `notifyResourceListChanged`, `notifyPromptListChanged`, and `notifyResourceUpdated` fired from inside a tool or resource handler now route through `extra.sendNotification` (which stamps `relatedRequestId`), so the notification travels on the POST request's SSE response stream instead of being silently dropped. stdio behavior is unchanged. Background/proactive notifications outside a request handler remain a gap — tracked in [#193](https://github.com/cyanheads/mcp-ts-core/issues/193). Closes [#135](https://github.com/cyanheads/mcp-ts-core/issues/135).

## Changed

- **`add-tool`, `api-canvas`, and `design-mcp-server` skills** updated with MCP-side list-filtering guidance — when and how to use `ctx.notify*` for incremental list updates vs. filter params on tool inputs.

## Security

- **`fetchWithTimeout` query-string redaction** — see Fixed above ([#190](https://github.com/cyanheads/mcp-ts-core/issues/190)).

## Dependency bumps

- `@cloudflare/vitest-pool-workers` ^0.16.10 → ^0.16.11 (dev)
- `@cloudflare/workers-types` 4.20260601.1 → 4.20260602.1 (dev, exact-pinned)
- `openai` ^6.39.1 → ^6.41.0 (dev + peer)
