---
summary: "Fresh-scaffold devcheck guards (changelog sync, git-dependent checks), check-skill-versions worktree-deletion guard, DuckdbProvider.describe() filter-qualification fix, seven skill version bumps, biome 2.5 + dependency refresh"
breaking: false
security: false
agent-notes: |
  Seven external skills got `metadata.version` bumps to propagate body drift that shipped pre-0.9.18 at equal versions (the version-gated Phase A sync skipped them): `api-auth` 1.1→1.2, `api-errors` 1.6→1.7, `api-services` 1.3→1.4, `api-telemetry` 1.0→1.1, `field-test` 2.5→2.6, `report-issue-local` 1.5→1.6, `tool-defs-analysis` 1.2→1.3. A maintenance pass on a consumer project now re-syncs these (Phase A picks up the higher version; Phase B mirrors into `.claude/skills/` and `.agents/skills/`). No new files to create.

  `biome.json` migrated to the 2.5.0 schema — the `linter.rules.recommended: true` shorthand is now `recommended` under a `preset` key. Consumer servers extending `@cyanheads/mcp-ts-core/biome` inherit this; a local `biome.json` that overrides the rules block should run `bunx @biomejs/biome migrate` after upgrading to biome 2.5.
---

# 0.10.7 — 2026-06-19

## Changed

- **`biome.json`** — biome `2.4.16` → `2.5.0`; `biome migrate` applied (`linter.rules.recommended: true` → `"preset": "recommended"`, `$schema` bumped to the 2.5.0 URL).
- **`package.json` `resolutions`** — dropped eight transitive override pins now resolved correctly by the upstream tree (`brace-expansion`, `flatted`, `handlebars`, `lodash`, `path-to-regexp`, `picomatch`, `protobufjs`, `yaml`); added `js-yaml` `^4.2.0`. `bun audit` is clean before and after.
- **`tests/unit/utils/scheduling/scheduler.test.ts`** — node-cron `4.4.x` ships a frozen ESM namespace, so `vi.spyOn(cron, 'validate')` throws "Module namespace is not configurable in ESM". Switched to `vi.mock('node-cron', …)` with `vi.hoisted` mock functions; the missing-peer and non-Node suites still override per-test via `vi.doMock` after `vi.resetModules()`.
- **Seven `skills/<name>/SKILL.md` `metadata.version` bumps** — propagate body drift that shipped pre-0.9.18 at equal versions, which the version-gated maintenance Phase A sync skipped: `api-auth` 1.1→1.2, `api-errors` 1.6→1.7, `api-services` 1.3→1.4, `api-telemetry` 1.0→1.1, `field-test` 2.5→2.6, `report-issue-local` 1.5→1.6, `tool-defs-analysis` 1.2→1.3. ([#238](https://github.com/cyanheads/mcp-ts-core/issues/238))
- **`skills/git-wrapup` v1.4** — tag-annotation guidance now permits one concise context line under the subject (one or two lines, never paragraph blocks); `Bash git only` rule restated without the git-mcp-server rationale.
- **`skills/orchestrations` v1.4** — isolation rule reworded: parallel sub-agents drive git through the shell against their own working directory, dropping the obsolete git-mcp-server leak note.

## Fixed

- **`DuckdbProvider.describe({ tableName })`** — qualified the pushed `WHERE` filters with the `t` alias (`t.table_name`, `t.table_type`, `t.table_schema`). The table-list query joins `information_schema.tables t` with `duckdb_tables()`, both exposing `table_name`, so the unqualified predicate raised a DuckDB Binder Error (ambiguous column) on every filtered `describe()`. The `table_type` arm was latent (`duckdb_tables()` exposes no such column) but is qualified for consistency. ([#235](https://github.com/cyanheads/mcp-ts-core/issues/235))
- **`scripts/build-changelog.ts`** — under `--check`, exits cleanly when `changelog/` holds no `<major.minor>.x/` version files. A fresh scaffold ships only `changelog/template.md` (excluded), so the prior directory-existence guard let `buildRollup()` throw on the first `devcheck`. A manual `changelog:build` still throws, surfacing an empty-tree mistake. ([#242](https://github.com/cyanheads/mcp-ts-core/issues/242))
- **`scripts/devcheck.ts`** — TODOs/FIXMEs, Tracked Secrets, and Framework Antipatterns now skip via a shared `isGitRepo()` guard when `.git` is absent. They shell out to `git grep` / `git ls-files`, which exit 128 (not a finding) on a fresh scaffold before `git init`; devcheck reported that as a failure. ([#243](https://github.com/cyanheads/mcp-ts-core/issues/243))
- **`scripts/check-framework-antipatterns.ts`** — self-guards at script top (`Skipped: not a git repository.`) for direct invocation outside a repo, mirroring `build-changelog.ts`. ([#243](https://github.com/cyanheads/mcp-ts-core/issues/243))
- **`scripts/check-skill-versions.ts`** — skips a `SKILL.md` deleted from the worktree (`existsSync` guard before `readFileSync`) instead of crashing with ENOENT. `git diff --name-only HEAD` lists deletions and `git show HEAD:<path>` still returns the blob, so the loop reached a read on a path no longer on disk — hit on every maintenance pass that prunes an upstream-removed skill. ([#237](https://github.com/cyanheads/mcp-ts-core/issues/237))

### Dependency bumps

- `@biomejs/biome` `2.4.16` → `2.5.0`
- `@hono/node-server` `^2.0.4` → `^2.0.5`
- `hono` `^4.12.25` → `^4.12.26`
- `@cloudflare/vitest-pool-workers` `^0.16.15` → `^0.16.18`
- `@cloudflare/workers-types` `4.20260611.1` → `4.20260619.1`
- `@duckdb/node-api` `^1.5.3-r.3` → `^1.5.4-r.1`
- `@supabase/supabase-js` `^2.108.1` → `^2.108.2`
- `@types/node` `25.9.3` → `26.0.0`
- `@vitest/coverage-istanbul` `4.1.8` → `4.1.9`
- `@vitest/ui` `4.1.8` → `4.1.9`
- `vitest` `^4.1.8` → `^4.1.9`
- `better-sqlite3` `^12.10.0` → `^12.11.1`
- `defuddle` `^0.18.1` → `^0.19.0`
- `fast-xml-parser` `^5.8.0` → `^5.9.3`
- `node-cron` `^4.2.1` → `^4.4.1`
- `openai` `^6.42.0` → `^6.44.0`
- `papaparse` `^5.5.3` → `^5.5.4`
- `repomix` `^1.14.1` → `^1.15.0`
