v1.10.21

Patch Changes

• #336 2383f4d - refactor: improve code quality by addressing SonarQube code smells

  Improved code readability and maintainability by addressing 7 code smell issues:

  • Use String#replaceAll() instead of replace() with global regex for better clarity
  • Convert forEach() to for...of loop for improved performance and readability
  • Use String.raw template literal to avoid unnecessary escaping in regex patterns

  These changes follow modern JavaScript/TypeScript best practices and reduce technical debt by 30 minutes. No functional changes or breaking changes introduced.

v1.10.20

Patch Changes

• #327 cd17f93 - chore: update dependencies to latest versions

  Updated production dependencies:

  • @modelcontextprotocol/sdk: 1.20.0 → 1.20.1
  • pino: 10.0.0 → 10.1.0
  • sonarqube-web-api-client: 0.11.1 → 1.0.1 (major update with stricter typing)

  Updated dev dependencies:

  • vite: 7.1.10 → 7.1.11
  • @cyclonedx/cdxgen: 11.9.0 → 11.10.0
  • @eslint/js: 9.37.0 → 9.38.0
  • @types/node: 24.7.2 → 24.8.1
  • eslint: 9.37.0 → 9.38.0

  Note: zod remains pinned to 3.25.76 to match @modelcontextprotocol/sdk dependency

v1.10.19

Patch Changes

• #325 75e683f - Update production dependencies to latest versions:

  • pino: 9.12.0 → 10.0.0 (major version update with improved performance)
  • pino-roll: 3.1.0 → 4.0.0 (compatible with Pino 10)
  • @types/node: 24.7.1 → 24.7.2 (minor type definition updates)
  • zod: kept at 3.25.76 (maintained for compatibility)

  All tests passing with no breaking changes identified.

v1.10.18

Patch Changes

• #320 105d75e - Fix Docker image publishing by adding packages:write permission to workflows

  The v1.10.17 build failed when attempting to push multi-platform Docker images to GitHub Container Registry (GHCR) with error: "denied: installation not allowed to Create organization package"

  Root cause: The reusable-docker.yml workflow was missing the packages: write permission needed to push images to GHCR. While the main workflow had this permission, reusable workflows require explicit permissions and do not inherit from their callers.

  Additionally, the PR workflow calls reusable-docker.yml, so it must also grant the permission even though PR builds don't use it (they use single-platform without push).

  This fix adds packages: write to:

  • .github/workflows/reusable-docker.yml - Required to push multi-platform images to GHCR
  • .github/workflows/pr.yml - Required to call reusable-docker.yml (permission not used in practice)

  The permission is only exercised when the workflow actually pushes to GHCR (multi-platform builds with save-artifact=true). PR builds continue to use single-platform without pushing to GHCR.

v1.10.16

Patch Changes

• #318 08ef441 - Fix race condition in artifact determination script

  • Add retry logic with exponential backoff to determine-artifact.sh
  • Wait up to 5 attempts with increasing delays (5s, 10s, 15s, 20s, 25s)
  • Fixes race condition where Publish workflow starts before Main workflow is indexed by GitHub API
  • Total retry window: ~75 seconds, giving GitHub's API time to index completed workflow runs

• #318 08ef441 - Fix Docker Hub publishing for multi-platform OCI images

  • Extract OCI layout from tar archive
  • Use docker buildx imagetools create with oci-layout:// scheme
  • Properly handles multi-platform manifest lists for linux/amd64 and linux/arm64
  • Fixes "unknown flag: --tag" error from incorrect buildx imagetools import syntax

v1.10.15

Patch Changes

• #317 b813a93 - Fix race condition in artifact determination script
  • Add retry logic with exponential backoff to determine-artifact.sh
  • Wait up to 5 attempts with increasing delays (5s, 10s, 15s, 20s, 25s)
  • Fixes race condition where Publish workflow starts before Main workflow is indexed by GitHub API
  • Total retry window: ~75 seconds, giving GitHub's API time to index completed workflow runs

v1.10.14

Patch Changes

• #316 8a104e2 - Fix multi-platform Docker image publishing using buildx imagetools
  • Replace skopeo with docker buildx imagetools for OCI archive handling
  • The imagetools command properly imports multi-platform manifest lists from OCI archives
  • Fixes error: "more than one image in oci, choose an image"
  • Ensures both linux/amd64 and linux/arm64 images are pushed correctly to Docker Hub

v1.10.13

Patch Changes

• #315 ac06fbe - Fix multi-platform Docker image publishing to Docker Hub
  • Change skopeo --all flag to --multi-arch all for proper OCI manifest list handling
  • Ensures both linux/amd64 and linux/arm64 images are pushed correctly
  • Fixes error: "more than one image in oci, choose an image"

v1.10.12

Patch Changes

• #314 2a31f70 - Fix NPM prepare script and Docker OCI push issues
  • NPM: Remove prepare script from package.json before publishing (--ignore-scripts doesn't skip prepare)
  • Docker: Use skopeo to push OCI archive directly to Docker Hub instead of loading to docker-daemon
  • Docker: Configure skopeo authentication with Docker Hub credentials

v1.10.11

Patch Changes

• #313 e17faac - Fix NPM and Docker publish failures
  • NPM: Add --ignore-scripts flag to prevent husky from running during publish
  • Docker: Use skopeo to load OCI format images from multi-platform builds instead of docker load