v1.7.17 2.12.0

Name: d2
Author: d2lang

high risk

d2lang/d2Aug 24, 2026 → Aug 25, 20261 day between releases

What's New

Major security release fixes critical CVEs in MCP endpoint and requires migration of configuration.

Breaking Changes

Legacy MCP config keys abort startup.
connectStdioMCP() removed from React client.
MCP URLs no longer follow HTTP redirects.
type field is now required on [[features.mcp.servers]] entries.

New Features

New React client functions connectMcp() and connectUserMcp().
SECURITY.md documentation added.

Improvements

Fixes critical command injection (CVE-2026-45018) and SSRF (CVE-2026-45019) vulnerabilities.
MCP stdio servers now declared server-side; client supplies only a name.

Upgrade Notes

Legacy MCP config keys abort startup and must be migrated to the new server-side model. React client users must update to use connectMcp() or connectUserMcp() instead of connectStdioMcp(). Ensure the type field is added to every [[features.mcp.servers]] entry.

The Two Releases

v1.7.17

Aug 24, 2026· 2 months ago

Fixes Eino checkpoint auto-resume issues and introduces per-turn token usage statistics.

Full release notes

2.12.0

Aug 25, 2026· 2 months ago

Security release fixing critical CVEs in the MCP endpoint, requiring migration of MCP configuration to a new server-side model.

Full release notes