js · @bitbonsai/mcpvaultHeads-up
@bitbonsai/mcpvault PathFilter deny-list anchored glob fix
PathFilter's deny-list glob patterns were anchored, so nested copies of .
What changed
PathFilter's deny-list glob patterns were anchored, so nested copies of .git, .obsidian, and node_modules inside the vault were not blocked. Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).
Who it affects
Users of @bitbonsai/mcpvault before version 0.11.5 who rely on PathFilter to block sensitive directories like .git, .obsidian, and node_modules.
What to do today
Update to version 0.11.5 or later to ensure nested restricted directories are properly blocked.
The trail
Collected→
Audited→
Written→
Published