Skip to content

Commit 3a6b1e9

Browse files
nicholasjpaternonicholasjpaterno
committed
chore: Release v3.0.0-beta.3
Security: - JWT algorithm confusion attack prevention (fail-closed validation) - Key-type/algorithm compatibility checks for JWKS - HTTPS enforcement for JWKS URLs - Removed Default impl for JwtConfig Added: - WorkerError wrapper for worker::Error → ToolError conversion - WorkerResultExt trait with .into_tool_result() method Documentation: - OAuth protection guide with 3 authentication patterns - Worker error integration examples - Security checklist for production deployments
1 parent 6e6b5aa commit 3a6b1e9

File tree

26 files changed

+110
-81
lines changed

26 files changed

+110
-81
lines changed

‎CHANGELOG.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [3.0.0-beta.3] - 2026-01-22
11+
12+
### Security
13+
14+
#### JWT Algorithm Confusion Attack Prevention (`turbomcp-wasm`)
15+
- **Fail-Closed Algorithm Validation** - Empty algorithm lists now return an error instead of bypassing validation
16+
- **Key-Type/Algorithm Compatibility** - RSA keys can only be used with RS* algorithms, EC keys with ES* algorithms
17+
- **Removed `Default` for `JwtConfig`** - Prevents accidental creation of insecure configurations
18+
- **HTTPS Enforcement for JWKS** - JWKS URLs must use HTTPS (localhost exempt for development)
19+
- Added `allow_insecure_http()` for development/testing only
20+
- Added comprehensive security tests for algorithm confusion and HTTPS validation
21+
22+
### Added
23+
24+
#### Worker Error Integration (`turbomcp-wasm`)
25+
- **`WorkerError` newtype wrapper** - Enables `worker::Error` to `ToolError` conversion via `.map_err(WorkerError)`
26+
- **`WorkerResultExt` trait** - Ergonomic `.into_tool_result()` method for `worker::Result<T>`
27+
- Both approaches enable full `?` operator support with Cloudflare Workers APIs (KV, Durable Objects, R2, D1, etc.)
28+
29+
### Documentation
30+
31+
#### OAuth and Authentication (`turbomcp-wasm`)
32+
- **Comprehensive OAuth Protection Guide** - Three authentication patterns documented:
33+
1. Cloudflare Access (recommended for production)
34+
2. Custom JWT Validation (for self-hosted OAuth/OIDC)
35+
3. Bearer Token (development only, with security warnings)
36+
- **Worker Error Integration Examples** - Usage examples for `WorkerError` and `WorkerResultExt`
37+
- **Security Checklist** - Production deployment checklist for authentication
38+
1039
## [3.0.0-beta.2] - 2026-01-20
1140

1241
### Documentation

‎Cargo.toml‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ testcontainers = "0.25.0"
184184
doc-comment = "0.3"
185185

186186
# Workspace dependencies are defined below
187-
# Internal crate dependencies - v3.0.0-beta.2
187+
# Internal crate dependencies - v3.0.0-beta.3
188188
#
189189
# NOTE on `default-features = false`:
190190
# - turbomcp-core: Has `default = ["std"]` - needed for no_std/WASM builds
@@ -194,32 +194,32 @@ doc-comment = "0.3"
194194
#
195195
# All other crates either have empty defaults (removed vestigial `default-features = false`)
196196
# or useful defaults that should be enabled by default.
197-
turbomcp = { version = "3.0.0-beta.2", path = "crates/turbomcp" }
197+
turbomcp = { version = "3.0.0-beta.3", path = "crates/turbomcp" }
198198
# v3.0: turbomcp-types is THE source of truth for all MCP types
199-
turbomcp-types = { version = "3.0.0-beta.2", path = "crates/turbomcp-types" }
199+
turbomcp-types = { version = "3.0.0-beta.3", path = "crates/turbomcp-types" }
200200
# v3.0: turbomcp-core re-extracted as no_std foundation layer
201-
turbomcp-core = { version = "3.0.0-beta.2", path = "crates/turbomcp-core", default-features = false }
201+
turbomcp-core = { version = "3.0.0-beta.3", path = "crates/turbomcp-core", default-features = false }
202202
# v3.0: turbomcp-transport-traits lean transport traits crate
203-
turbomcp-transport-traits = { version = "3.0.0-beta.2", path = "crates/turbomcp-transport-traits" }
203+
turbomcp-transport-traits = { version = "3.0.0-beta.3", path = "crates/turbomcp-transport-traits" }
204204
# v3.0: Individual transport crates (extracted from monolithic turbomcp-transport)
205-
turbomcp-stdio = { version = "3.0.0-beta.2", path = "crates/turbomcp-stdio" }
206-
turbomcp-http = { version = "3.0.0-beta.2", path = "crates/turbomcp-http" }
207-
turbomcp-websocket = { version = "3.0.0-beta.2", path = "crates/turbomcp-websocket" }
208-
turbomcp-tcp = { version = "3.0.0-beta.2", path = "crates/turbomcp-tcp" }
209-
turbomcp-unix = { version = "3.0.0-beta.2", path = "crates/turbomcp-unix" }
210-
turbomcp-protocol = { version = "3.0.0-beta.2", path = "crates/turbomcp-protocol" }
211-
turbomcp-transport = { version = "3.0.0-beta.2", path = "crates/turbomcp-transport", default-features = false }
212-
turbomcp-client = { version = "3.0.0-beta.2", path = "crates/turbomcp-client" }
213-
turbomcp-server = { version = "3.0.0-beta.2", path = "crates/turbomcp-server" }
214-
turbomcp-macros = { version = "3.0.0-beta.2", path = "crates/turbomcp-macros" }
215-
turbomcp-cli = { version = "3.0.0-beta.2", path = "crates/turbomcp-cli" }
205+
turbomcp-stdio = { version = "3.0.0-beta.3", path = "crates/turbomcp-stdio" }
206+
turbomcp-http = { version = "3.0.0-beta.3", path = "crates/turbomcp-http" }
207+
turbomcp-websocket = { version = "3.0.0-beta.3", path = "crates/turbomcp-websocket" }
208+
turbomcp-tcp = { version = "3.0.0-beta.3", path = "crates/turbomcp-tcp" }
209+
turbomcp-unix = { version = "3.0.0-beta.3", path = "crates/turbomcp-unix" }
210+
turbomcp-protocol = { version = "3.0.0-beta.3", path = "crates/turbomcp-protocol" }
211+
turbomcp-transport = { version = "3.0.0-beta.3", path = "crates/turbomcp-transport", default-features = false }
212+
turbomcp-client = { version = "3.0.0-beta.3", path = "crates/turbomcp-client" }
213+
turbomcp-server = { version = "3.0.0-beta.3", path = "crates/turbomcp-server" }
214+
turbomcp-macros = { version = "3.0.0-beta.3", path = "crates/turbomcp-macros" }
215+
turbomcp-cli = { version = "3.0.0-beta.3", path = "crates/turbomcp-cli" }
216216
# v3.0: OpenTelemetry integration and observability
217-
turbomcp-telemetry = { version = "3.0.0-beta.2", path = "crates/turbomcp-telemetry" }
218-
turbomcp-dpop = { version = "3.0.0-beta.2", path = "crates/turbomcp-dpop" }
217+
turbomcp-telemetry = { version = "3.0.0-beta.3", path = "crates/turbomcp-telemetry" }
218+
turbomcp-dpop = { version = "3.0.0-beta.3", path = "crates/turbomcp-dpop" }
219219
# v3.0: Wire format codec abstraction (no_std compatible)
220-
turbomcp-wire = { version = "3.0.0-beta.2", path = "crates/turbomcp-wire", default-features = false }
220+
turbomcp-wire = { version = "3.0.0-beta.3", path = "crates/turbomcp-wire", default-features = false }
221221
# v3.0: WASM server proc macros
222-
turbomcp-wasm-macros = { version = "3.0.0-beta.2", path = "crates/turbomcp-wasm-macros" }
222+
turbomcp-wasm-macros = { version = "3.0.0-beta.3", path = "crates/turbomcp-wasm-macros" }
223223

224224
[profile.dev]
225225
opt-level = 1

‎crates/turbomcp-auth/Cargo.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[package]
22
name = "turbomcp-auth"
33

4-
version = "3.0.0-beta.2"
4+
version = "3.0.0-beta.3"
55

66
edition = "2024"
77
authors = ["Nicholas Paterno <nick@epistates.com>"]
@@ -71,10 +71,10 @@ dashmap = { version = "6.1.0", optional = true } # Concurrent HashMap for cachi
7171

7272
# Internal dependencies
7373

74-
turbomcp-protocol = { version = "3.0.0-beta.2", path = "../turbomcp-protocol" }
74+
turbomcp-protocol = { version = "3.0.0-beta.3", path = "../turbomcp-protocol" }
7575

7676
# Optional: DPoP support
77-
turbomcp-dpop = { version = "3.0.0-beta.2", path = "../turbomcp-dpop", optional = true }
77+
turbomcp-dpop = { version = "3.0.0-beta.3", path = "../turbomcp-dpop", optional = true }
7878

7979
# Optional: DPoP support
8080

‎crates/turbomcp-cli/Cargo.toml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[package]
22
name = "turbomcp-cli"
33

4-
version = "3.0.0-beta.2"
4+
version = "3.0.0-beta.3"
55

66
edition = "2024"
77
authors = ["Nicholas Paterno <nick@epistates.com>"]
@@ -17,9 +17,9 @@ rust-version = "1.89.0"
1717
[dependencies]
1818
# Core TurboMCP
1919

20-
turbomcp-client = { path = "../turbomcp-client", version = "3.0.0-beta.2" }
21-
turbomcp-transport = { path = "../turbomcp-transport", version = "3.0.0-beta.2" }
22-
turbomcp-protocol = { path = "../turbomcp-protocol", version = "3.0.0-beta.2" }
20+
turbomcp-client = { path = "../turbomcp-client", version = "3.0.0-beta.3" }
21+
turbomcp-transport = { path = "../turbomcp-transport", version = "3.0.0-beta.3" }
22+
turbomcp-protocol = { path = "../turbomcp-protocol", version = "3.0.0-beta.3" }
2323

2424
# CLI framework
2525
clap = { workspace = true, features = ["derive", "env", "string"] }

‎crates/turbomcp-client/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[package]
22
name = "turbomcp-client"
33

4-
version = "3.0.0-beta.2"
4+
version = "3.0.0-beta.3"
55

66
edition = "2024"
77
authors = ["Nicholas Paterno <nick@epistates.com>"]

‎crates/turbomcp-core/Cargo.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "turbomcp-core"
3-
version = "3.0.0-beta.2"
3+
version = "3.0.0-beta.3"
44
edition = "2024"
55
authors = ["Nicholas Paterno <nick@epistates.com>"]
66
description = "Core MCP types and primitives - no_std compatible for WASM targets"
@@ -14,7 +14,7 @@ rust-version = "1.89.0"
1414

1515
[dependencies]
1616
# Types (single source of truth)
17-
turbomcp-types = { version = "3.0.0-beta.2", path = "../turbomcp-types" }
17+
turbomcp-types = { version = "3.0.0-beta.3", path = "../turbomcp-types" }
1818

1919
# Serialization (no_std compatible with alloc)
2020
serde = { version = "1.0", default-features = false, features = ["derive", "alloc"] }

‎crates/turbomcp-dpop/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[package]
22
name = "turbomcp-dpop"
33

4-
version = "3.0.0-beta.2"
4+
version = "3.0.0-beta.3"
55

66
edition = "2024"
77
authors = ["Nicholas Paterno <nick@epistates.com>"]

‎crates/turbomcp-grpc/Cargo.toml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "turbomcp-grpc"
3-
version = "3.0.0-beta.2"
3+
version = "3.0.0-beta.3"
44
edition = "2024"
55
authors = ["Nicholas Paterno <nick@epistates.com>"]
66
description = "gRPC transport for TurboMCP - high-performance MCP over HTTP/2"
@@ -29,9 +29,9 @@ tokio-stream = { version = "0.1", features = ["net"] }
2929
futures = "0.3"
3030

3131
# Internal dependencies
32-
turbomcp-core = { version = "3.0.0-beta.2", path = "../turbomcp-core", default-features = false, features = ["std"] }
33-
turbomcp-protocol = { version = "3.0.0-beta.2", path = "../turbomcp-protocol", default-features = false }
34-
turbomcp-transport-traits = { version = "3.0.0-beta.2", path = "../turbomcp-transport-traits", default-features = false }
32+
turbomcp-core = { version = "3.0.0-beta.3", path = "../turbomcp-core", default-features = false, features = ["std"] }
33+
turbomcp-protocol = { version = "3.0.0-beta.3", path = "../turbomcp-protocol", default-features = false }
34+
turbomcp-transport-traits = { version = "3.0.0-beta.3", path = "../turbomcp-transport-traits", default-features = false }
3535

3636
# Tower integration
3737
tower = { workspace = true }

‎crates/turbomcp-http/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "turbomcp-http"
3-
version = "3.0.0-beta.2"
3+
version = "3.0.0-beta.3"
44
edition = "2024"
55
authors = ["Nicholas Paterno <nick@epistates.com>"]
66
description = "HTTP/SSE transport implementation for MCP (Model Context Protocol) - Client transport"

‎crates/turbomcp-macros/Cargo.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "turbomcp-macros"
3-
version = "3.0.0-beta.2"
3+
version = "3.0.0-beta.3"
44
edition = "2024"
55
description = "Procedural macros for ergonomic MCP tool and resource registration"
66
license = "MIT"
@@ -32,8 +32,8 @@ schemars = { version = "1.0" }
3232
axum = { workspace = true, optional = true }
3333
tokio = { workspace = true, optional = true }
3434

35-
turbomcp-protocol = { version = "3.0.0-beta.2", path = "../turbomcp-protocol" }
36-
turbomcp-transport = { version = "3.0.0-beta.2", path = "../turbomcp-transport", optional = true }
35+
turbomcp-protocol = { version = "3.0.0-beta.3", path = "../turbomcp-protocol" }
36+
turbomcp-transport = { version = "3.0.0-beta.3", path = "../turbomcp-transport", optional = true }
3737

3838
[dev-dependencies]
3939
async-trait = "0.1"

0 commit comments

Comments
 (0)