---
summary: Security patches for critical protobufjs and moderate hono advisories, OTel peer dep range alignment, dependency sweep to latest
breaking: false
---

# 0.3.6 — 2026-04-19

Security patches for two transitive/direct advisories, dependency sweep to latest, and skill guidance on tool description structure.

## Security

- **Patched critical protobufjs advisory** (GHSA-xq3m-2v4x-88gg, CVSS 9.4) — added `protobufjs: 7.5.5` to `resolutions` to override the vulnerable 7.5.4 pulled transitively by `@grpc/proto-loader` through the OTel gRPC exporters.
- **Patched moderate hono advisory** (GHSA-458j-xx4x-4375, hono/jsx SSR HTML injection) — bumped `hono` 4.12.12 → 4.12.14 in both direct dependencies and resolutions.

## Added

- **`design-mcp-server` skill — single-paragraph tool description guidance** — new bullet recommends packing operational guidance into one cohesive paragraph rather than bullet lists or blank-line-separated sections, since descriptions render inline in most clients and operation-by-operation bullets duplicate info that lives in the `operation` enum's `.describe()` (#33).
- **`add-tool` skill — template comment** — mirrors the single-paragraph guidance as a comment above `description:` in the scaffold so authors see it at scaffold time.

## Changed

- **OpenTelemetry peer dependency ranges aligned with dev deps** — `^0.215.0` for `instrumentation-http`, `exporter-metrics-otlp-http`, `exporter-trace-otlp-http`, `sdk-node`; `^0.61.0` for `instrumentation-pino`; `^2.7.0` for `resources`, `sdk-metrics`, `sdk-trace-node`. Consumers pinned to 0.214/2.6 ranges will need to update.
- **Other peer dependency minimums refreshed** — `@supabase/supabase-js` ^2.99.3 → ^2.103.3, `openai` ^6.32.0 → ^6.34.0, `sanitize-html` ^2.17.2 → ^2.17.3, `unpdf` ^1.4.0 → ^1.6.0, `validator` ^13.15.26 → ^13.15.35, `js-yaml` ^4.1.0 → ^4.1.1.
- **Dropped `@types/diff` devDependency** — `diff` 9.0.0 ships its own TypeScript types; the `@types/diff` stub is deprecated.

## Dependencies

- `@biomejs/biome` 2.4.11 → 2.4.12
- `@cloudflare/workers-types` ^4.20260413.1 → ^4.20260418.1
- `@hono/node-server` ^1.19.13 → ^1.19.14
- `@modelcontextprotocol/ext-apps` ^1.5.0 → ^1.6.0
- `@opentelemetry/exporter-metrics-otlp-http` ^0.214.0 → ^0.215.0
- `@opentelemetry/exporter-trace-otlp-http` ^0.214.0 → ^0.215.0
- `@opentelemetry/instrumentation-http` ^0.214.0 → ^0.215.0
- `@opentelemetry/instrumentation-pino` ^0.60.0 → ^0.61.0
- `@opentelemetry/resources` ^2.6.1 → ^2.7.0
- `@opentelemetry/sdk-metrics` ^2.6.1 → ^2.7.0
- `@opentelemetry/sdk-node` ^0.214.0 → ^0.215.0
- `@opentelemetry/sdk-trace-node` ^2.6.1 → ^2.7.0
- `@supabase/supabase-js` ^2.103.0 → ^2.103.3
- `diff` 8.0.4 → 9.0.0 (resolution + peer)
- `dotenv` ^17.4.1 → ^17.4.2
- `fast-check` ^4.6.0 → ^4.7.0
- `hono` 4.12.12 → 4.12.14 (direct + resolution)
- `msw` ^2.13.2 → ^2.13.4
- `sanitize-html` ^2.17.2 → ^2.17.3
- `typescript` ^6.0.2 → ^6.0.3
- `unpdf` ^1.5.0 → ^1.6.0
