Guides

Release-Note Corrections

This page is the durable home for corrections to already-published AppTheory release notes. It exists because CHANGELOG.md is generated by Release Please, and Release Please never regenerates a past release section: a new release appends one new section built from the commits since the last release tag. A release note therefore freezes at the shape it had when its tag was cut, and a hand edit to a published section would be dropped or duplicated the next time Release Please rebuilds the file.

Corrections are recorded here instead, and the next generated release carries a visible correction entry because the correcting change lands as a release-visible fix(docs): commit (see Release Process).

  • Which release note is incomplete.
  • The omitted entry, with the commit and pull request that shipped it.
  • The consumer action that closes the gap.

v6.0.0 — omitted ⚠ BREAKING CHANGES entry for MCP transport authentication

Incomplete release note. The 6.0.0 section of CHANGELOG.md lists five ⚠ BREAKING CHANGES entries. It does not list the MCP transport-authorizer default change, even though that change makes credential-free requests to MCP transport routes fail where they previously succeeded.

Omitted entry. fix(security): M2 MCP facade authentication and task runtime hardening (Go/TS/Py/CDK) — pull request #1124, commit b3ef924. The entry is present in the 6.0.0 Bug Fixes list, so the change is documented; what is missing is the breaking-change classification. Its commit body states the change directly:

fix(cdk): require credentials on MCP transport routes by default

AppTheoryMcpServer MCP transport routes (POST, GET, and DELETE on every MCP pattern) now attach a real authorizer instead of an explicit HttpNoneAuthorizer that overrode any API default. The default is an IAM authorizer, so credential-free requests are rejected by API Gateway; transportAuthorizer selects an explicit JWT issuer/audience instead. Discovery, protected-resource metadata, authorize, and token routes stay explicitly public because OAuth clients must reach them before they hold a token. unauthenticatedMcp: true remains the explicit opt-out.

Consumer action. Read UPGRADING.md, section MCP transport routes require credentials by default. A consumer that relied on credential-free MCP transport routes must either accept the transport authorizer or select a posture explicitly. On the 6.0.0 tag that means configuring transportAuthorizer (issuer + non-empty audience) or the explicit unauthenticatedMcp: true opt-out; on the v6.x line that section’s successor is transportPosture — see MCP route algebra v2, route-aware bearer validation, and the RFC 9728/8707 challenge, where unauthenticatedMcp is removed in favour of transportPosture: none-public, which is never a default and carries the defense-in-depth floor.

What is deliberately not done here

  • The published 6.0.0 tag and its assets are immutable and are never rewritten.
  • The generated 6.0.0 section of CHANGELOG.md is not hand-edited: Release Please owns the file, and a later generated release would drop or duplicate the edit.
  • No past release is re-cut and no tag moves.

Operator step for the published 6.0.0 GitHub Release body

The 6.0.0 GitHub Release body is not regenerated by Release Please after publish. It is a GitHub Release body rather than a git object, so it can be edited, but that edit is outside Release Please ownership and is an operator action, not a steward action. Operator decision (2026-10-12): the operator edits the 6.0.0 Release body once to add the omitted bullet, or explicitly declines and relies on this page plus the next generated release entry. The recommended bullet, to be appended to the ⚠ BREAKING CHANGES list of that Release body:

* **cdk:** MCP transport routes on AppTheoryMcpServer now require credentials by default — the transport routes attach
  an IAM authorizer instead of an explicit none authorizer, so a credential-free request is rejected by API Gateway.
  Configure `transportAuthorizer` for a static JWT issuer/audience, or opt out explicitly. See UPGRADING.md, "MCP
  transport routes require credentials by default" (commit b3ef924, PR #1124).

Adding a future correction

  1. Add a section here naming the release, the omitted or wrong entry, the commit and pull request, and the consumer action, in the same shape as the v6.0.0 section above.
  2. Land the correcting change as a release-visible Conventional Commit (fix: or feat:) so the next generated release section carries the correction. A docs:-typed commit alone is not rendered into the generated section.
  3. State the operator action for any immutable artifact (a published tag, a GitHub Release body), as this page does for 6.0.0.