Starstruk Logo MarkStarstruk

v0.1.7 v0.8.6

medium risk

MCP-UI-Org/mcp-uiSep 2, 2026 → Sep 3, 20262 days between releases

What's New

Addresses critical security vulnerabilities, adds custom API authentication functions, and fixes numerous widget and Docker issues.

New Features

  • Added `withAllowInsecure` function to `custom-api`
  • Added `withBasicAuth` function to `custom-api`

Improvements

  • Videos widget now caches and reuses video lists if an update fails for a channel
  • Fixed X-Forwarded-For spoofing vulnerability allowing rate-limit bypass
  • Search bang indicator now clears correctly after pressing `enter`

Bug Fixes

  • Fixed Reddit widget not fetching new posts due to challenge page changes
  • Fixed Docker containers not being identified as unhealthy correctly
  • Fixed X-Forwarded-For spoofing vulnerability allowing rate-limit bypass
  • Fixed RSS feeds not showing correct thumbnails when image URL is a relative path
  • Fixed incorrect `manifest.json` path when using `base-url`

Upgrade Notes

Users can now use `withBasicAuth` and `withAllowInsecure` when configuring custom APIs. The videos widget now caches video lists on update failure, and the manifest path handling has been updated.

The Two Releases

v0.1.7

v0.1.7

Sep 2, 2026· 2 months ago

Adds on-demand SERP depth loading and fixes several bugs related to SAM crashes, Search Console integration, and browser compatibility.

Full release notes
v0.8.6

v0.8.6

Sep 3, 2026· 2 months ago

This release addresses critical security vulnerabilities, fixes the Reddit widget's inability to fetch posts, and resolves issues with Docker container health checks and currency display.

Full release notes