IA Squad
SearchPT
js · @bitbonsai/mcpvaultHeads-up

@bitbonsai/mcpvault PathFilter deny-list anchored glob fix

PathFilter's deny-list glob patterns were anchored, so nested copies of .

20 Jun 2026Read 1 minSeverity: schedule it

What changed

PathFilter's deny-list glob patterns were anchored, so nested copies of .git, .obsidian, and node_modules inside the vault were not blocked. Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).

Who it affects

Users of @bitbonsai/mcpvault before version 0.11.5 who rely on PathFilter to block sensitive directories like .git, .obsidian, and node_modules.

What to do today

Update to version 0.11.5 or later to ensure nested restricted directories are properly blocked.

The trail
Collected Audited Written Published