Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package github-mcp-server for
openSUSE:Factory checked in at 2026-09-09 16:20:57
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/github-mcp-server (Old)
and /work/SRC/openSUSE:Factory/.github-mcp-server.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "github-mcp-server"
Wed Sep 9 16:20:57 2026 rev:7 rq:1376542 version:1.12.1
Changes:
--------
--- /work/SRC/openSUSE:Factory/github-mcp-server/github-mcp-server.changes
2026-09-07 11:31:46.684146112 +0200
+++
/work/SRC/openSUSE:Factory/.github-mcp-server.new.1265/github-mcp-server.changes
2026-09-09 16:22:58.200577236 +0200
@@ -1,0 +2,15 @@
+Wed Sep 9 06:20:15 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Update to version 1.12.1:
+ * OAuth protected-resource metadata now advertises only the
+ default scopes instead of the full step-up catalogue, so
+ clients no longer request delete_repo, workflow and
+ administrative scopes at login.
+ * assign_copilot_to_issue and
+ assign_copilot_to_issue_with_intent reject a missing
+ owner, repo or issue_number with a clear parameter error
+ instead of a confusing repository-resolution failure.
+- Vendored Go modules are unchanged (go.mod/go.sum identical to
+ 1.12.0).
+
+-------------------------------------------------------------------
Old:
----
github-mcp-server-1.12.0.tar.zst
New:
----
github-mcp-server-1.12.1.tar.zst
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ github-mcp-server.spec ++++++
--- /var/tmp/diff_new_pack.UK2EP9/_old 2026-09-09 16:22:59.122615771 +0200
+++ /var/tmp/diff_new_pack.UK2EP9/_new 2026-09-09 16:22:59.124615855 +0200
@@ -23,7 +23,7 @@
# -modcacherw leave the module cache writable so cleanup cannot fail
%define goflags "-buildmode=pie -mod=vendor -modcacherw"
Name: github-mcp-server
-Version: 1.12.0
+Version: 1.12.1
Release: 0
Summary: Model Context Protocol server for GitHub
License: MIT
++++++ _service ++++++
--- /var/tmp/diff_new_pack.UK2EP9/_old 2026-09-09 16:22:59.173617903 +0200
+++ /var/tmp/diff_new_pack.UK2EP9/_new 2026-09-09 16:22:59.177618070 +0200
@@ -3,8 +3,8 @@
<param name="url">https://github.com/github/github-mcp-server</param>
<param name="scm">git</param>
<param name="exclude">.git</param>
- <param name="revision">v1.12.0</param>
- <param name="version">1.12.0</param>
+ <param name="revision">v1.12.1</param>
+ <param name="version">1.12.1</param>
<param name="changesgenerate">disable</param>
</service>
<service name="recompress" mode="manual">
@@ -13,7 +13,7 @@
</service>
<service name="go_modules" mode="manual">
<param name="compression">zst</param>
- <param name="archive">github-mcp-server-1.12.0.tar.zst</param>
+ <param name="archive">github-mcp-server-1.12.1.tar.zst</param>
</service>
</services>
++++++ github-mcp-server-1.12.0.tar.zst -> github-mcp-server-1.12.1.tar.zst
++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/github-mcp-server-1.12.0/Dockerfile
new/github-mcp-server-1.12.1/Dockerfile
--- old/github-mcp-server-1.12.0/Dockerfile 2026-09-03 15:56:57.000000000
+0200
+++ new/github-mcp-server-1.12.1/Dockerfile 2026-09-08 20:58:41.000000000
+0200
@@ -7,7 +7,7 @@
RUN mkdir -p ./pkg/github/ui_dist && \
cd ui && npm run build
-FROM
golang:1.27.0-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc
AS build
+FROM
golang:1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125
AS build
ARG VERSION="dev"
# Set the working directory
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/github-mcp-server-1.12.0/docs/streamable-http.md
new/github-mcp-server-1.12.1/docs/streamable-http.md
--- old/github-mcp-server-1.12.0/docs/streamable-http.md 2026-09-03
15:56:57.000000000 +0200
+++ new/github-mcp-server-1.12.1/docs/streamable-http.md 2026-09-08
20:58:41.000000000 +0200
@@ -72,13 +72,23 @@
],
"scopes_supported": [
"repo",
- ...
+ "read:org",
+ "read:user",
+ "user:email",
+ "read:packages",
+ "write:packages",
+ "read:project",
+ "project",
+ "gist",
+ "notifications"
],
...
}
```
This allows OAuth clients to discover authentication requirements and endpoint
information automatically.
+Scopes excluded from this default set, such as `delete_repo`, are requested
only
+through a per-tool OAuth authorization challenge when needed.
The HTTP server is the OAuth protected resource, not the authorization server.
It
therefore serves `/.well-known/oauth-protected-resource` but does not serve
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/github-mcp-server-1.12.0/pkg/github/copilot.go
new/github-mcp-server-1.12.1/pkg/github/copilot.go
--- old/github-mcp-server-1.12.0/pkg/github/copilot.go 2026-09-03
15:56:57.000000000 +0200
+++ new/github-mcp-server-1.12.1/pkg/github/copilot.go 2026-09-08
20:58:41.000000000 +0200
@@ -214,6 +214,19 @@
return utils.NewToolResultError(err.Error()),
nil, nil
}
+ // owner, repo and issue_number are required, but
WeakDecode zero-fills a
+ // missing value, so a missing arg reached the query as
a confusing
+ // "Could not resolve to a Repository" error. Reject
the zero values.
+ if params.Owner == "" {
+ return utils.NewToolResultError("missing
required parameter: owner"), nil, nil
+ }
+ if params.Repo == "" {
+ return utils.NewToolResultError("missing
required parameter: repo"), nil, nil
+ }
+ if params.IssueNumber == 0 {
+ return utils.NewToolResultError("missing
required parameter: issue_number"), nil, nil
+ }
+
client, err := deps.GetGQLClient(ctx)
if err != nil {
return nil, nil, fmt.Errorf("failed to get
GitHub client: %w", err)
@@ -588,6 +601,19 @@
return utils.NewToolResultError(err.Error()),
nil, nil
}
+ // owner, repo and issue_number are required, but
WeakDecode zero-fills a
+ // missing value, so reject the zero values (as with
rationale/confidence
+ // below) before they reach the query as a confusing
repository error.
+ if params.Owner == "" {
+ return utils.NewToolResultError("missing
required parameter: owner"), nil, nil
+ }
+ if params.Repo == "" {
+ return utils.NewToolResultError("missing
required parameter: repo"), nil, nil
+ }
+ if params.IssueNumber == 0 {
+ return utils.NewToolResultError("missing
required parameter: issue_number"), nil, nil
+ }
+
// Validate rationale length (rune count, matching the
granular assignee tools).
rationale := strings.TrimSpace(params.Rationale)
if rationale == "" {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/github-mcp-server-1.12.0/pkg/github/copilot_test.go
new/github-mcp-server-1.12.1/pkg/github/copilot_test.go
--- old/github-mcp-server-1.12.0/pkg/github/copilot_test.go 2026-09-03
15:56:57.000000000 +0200
+++ new/github-mcp-server-1.12.1/pkg/github/copilot_test.go 2026-09-08
20:58:41.000000000 +0200
@@ -60,6 +60,36 @@
expectedToolErrMsg string
}{
{
+ name: "missing owner is rejected",
+ requestArgs: map[string]any{
+ "repo": "repo",
+ "issue_number": float64(123),
+ },
+ mockedClient: githubv4mock.NewMockedHTTPClient(),
+ expectToolError: true,
+ expectedToolErrMsg: "missing required parameter: owner",
+ },
+ {
+ name: "missing repo is rejected",
+ requestArgs: map[string]any{
+ "owner": "owner",
+ "issue_number": float64(123),
+ },
+ mockedClient: githubv4mock.NewMockedHTTPClient(),
+ expectToolError: true,
+ expectedToolErrMsg: "missing required parameter: repo",
+ },
+ {
+ name: "missing issue_number is rejected",
+ requestArgs: map[string]any{
+ "owner": "owner",
+ "repo": "repo",
+ },
+ mockedClient: githubv4mock.NewMockedHTTPClient(),
+ expectToolError: true,
+ expectedToolErrMsg: "missing required parameter:
issue_number",
+ },
+ {
name: "successful assignment when there are no existing
assignees",
requestArgs: map[string]any{
"owner": "owner",
@@ -1229,6 +1259,19 @@
expectSuggestion bool
}{
{
+ name: "missing owner is rejected",
+ requestArgs: map[string]any{
+ "repo": "repo",
+ "issue_number": float64(123),
+ "rationale": "Well-scoped task.",
+ "confidence": "HIGH",
+ "is_suggestion": false,
+ },
+ mockedClient: githubv4mock.NewMockedHTTPClient(),
+ expectToolError: true,
+ expectedToolErrMsg: "missing required parameter: owner",
+ },
+ {
name: "direct assignment with rationale and confidence
preserves existing assignees",
requestArgs: map[string]any{
"owner": "owner",
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/github-mcp-server-1.12.0/pkg/http/oauth/oauth.go
new/github-mcp-server-1.12.1/pkg/http/oauth/oauth.go
--- old/github-mcp-server-1.12.0/pkg/http/oauth/oauth.go 2026-09-03
15:56:57.000000000 +0200
+++ new/github-mcp-server-1.12.1/pkg/http/oauth/oauth.go 2026-09-08
20:58:41.000000000 +0200
@@ -20,13 +20,12 @@
OAuthProtectedResourcePrefix = "/.well-known/oauth-protected-resource"
)
-// SupportedScopes lists every OAuth scope that an MCP tool may require. HTTP
-// protected-resource metadata advertises this full set so clients can step up
-// authorization for tools excluded from the default grant.
+// SupportedScopes lists every OAuth scope that an MCP tool may require.
var SupportedScopes = scopes.SupportedOAuthScopes()
-// DefaultScopes are requested by stdio OAuth unless the operator explicitly
-// supplies --oauth-scopes. High-risk scopes such as delete_repo require
opt-in.
+// DefaultScopes are advertised in protected-resource metadata and requested by
+// stdio OAuth unless the operator explicitly supplies --oauth-scopes. Other
+// scopes require opt-in through a per-tool authorization challenge.
var DefaultScopes = scopes.DefaultOAuthScopes()
// Config holds the OAuth configuration for the MCP server.
@@ -128,7 +127,7 @@
Resource: resourceURL,
AuthorizationServers:
[]string{authorizationServerURL},
ResourceName: "GitHub MCP Server",
- ScopesSupported: SupportedScopes,
+ ScopesSupported: DefaultScopes,
BearerMethodsSupported: []string{"header"},
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/github-mcp-server-1.12.0/pkg/http/oauth/oauth_test.go
new/github-mcp-server-1.12.1/pkg/http/oauth/oauth_test.go
--- old/github-mcp-server-1.12.0/pkg/http/oauth/oauth_test.go 2026-09-03
15:56:57.000000000 +0200
+++ new/github-mcp-server-1.12.1/pkg/http/oauth/oauth_test.go 2026-09-08
20:58:41.000000000 +0200
@@ -436,7 +436,18 @@
host: "api.example.com",
method: http.MethodGet,
expectedStatusCode: http.StatusOK,
- expectedScopes: SupportedScopes,
+expectedScopes: []string{
+ "repo",
+ "read:org",
+ "read:user",
+ "user:email",
+ "read:packages",
+ "write:packages",
+ "read:project",
+ "project",
+ "gist",
+ "notifications",
+ },
validateResponse: func(t *testing.T, body
map[string]any) {
t.Helper()
assert.Equal(t, "GitHub MCP Server",
body["resource_name"])
@@ -573,7 +584,12 @@
if tc.expectedScopes != nil {
scopes, ok :=
body["scopes_supported"].([]any)
require.True(t, ok)
- assert.Len(t, scopes,
len(tc.expectedScopes))
+ actualScopes := make([]string,
len(scopes))
+ for i, scope := range scopes {
+ actualScopes[i], ok =
scope.(string)
+ require.True(t, ok)
+ }
+ assert.Equal(t, tc.expectedScopes,
actualScopes)
}
}
})
@@ -671,10 +687,20 @@
assert.Equal(t, expectedScopes, SupportedScopes)
}
-func TestDefaultScopesRequiresExplicitDeleteRepoOptIn(t *testing.T) {
+func TestDefaultScopesRequireExplicitOptIn(t *testing.T) {
assert.Subset(t, SupportedScopes, DefaultScopes)
assert.Contains(t, SupportedScopes, "delete_repo")
assert.NotContains(t, DefaultScopes, "delete_repo")
+ assert.Contains(t, SupportedScopes, "workflow")
+ assert.NotContains(t, DefaultScopes, "workflow")
+ assert.Contains(t, SupportedScopes, "codespace")
+ assert.NotContains(t, DefaultScopes, "codespace")
+ assert.Contains(t, SupportedScopes, "admin:org")
+ assert.NotContains(t, DefaultScopes, "admin:org")
+ assert.Contains(t, SupportedScopes, "read:enterprise")
+ assert.NotContains(t, DefaultScopes, "read:enterprise")
+ assert.Contains(t, SupportedScopes, "admin:enterprise")
+ assert.NotContains(t, DefaultScopes, "admin:enterprise")
assert.Contains(t, DefaultScopes, "repo")
}
