From 3a1358b5441f80b7f9251d170228ab2d00f01065 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:35:11 +0000
Subject: [PATCH] chore: bump version to 0.15.0

---
 CHANGELOG.md      | 2 ++
 manifest.json     | 2 +-
 package-lock.json | 4 ++--
 package.json      | 2 +-
 server.json       | 4 ++--
 5 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb70ed1..e3a46fd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,7 @@
 ## Unreleased
 
+## 0.15.0 - 2026-10-08
+
 ### Security
 
 - **Temporary resource ownership is now keyed on the caller's token, not on the unverified username claim inside it.** `TemporaryDataResource.read()` gated access to cached large tool responses (route geometry, isochrone GeoJSON, static-map images, `render_map_tool` payload refs) by comparing the resource's recorded owner to `getUserNameFromToken(callerToken)`. That helper base64-decodes the JWT payload and returns the `u` field with no signature verification — and none is possible here, since Mapbox signs its tokens with a secret this server does not hold. The entire authorization decision therefore rested on a claim the caller controls: anyone who knew a resource URI and the owner's Mapbox username could fabricate a token asserting that username and read the cached data. Unlike a tool invocation, which hands the token to a live Mapbox API call that rejects a fake, the resource read never made that call, so nothing downstream caught it.
diff --git a/manifest.json b/manifest.json
index c955bea..18ade6f 100644
--- a/manifest.json
+++ b/manifest.json
@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "display_name": "Mapbox MCP Server",
   "name": "@mapbox/mcp-server",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Mapbox MCP server.",
   "author": {
     "name": "Mapbox, Inc."
diff --git a/package-lock.json b/package-lock.json
index 74424fb..0a48db2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@mapbox/mcp-server",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@mapbox/mcp-server",
-      "version": "0.14.0",
+      "version": "0.15.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index ae30176..30db147 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/mcp-server",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Mapbox MCP server.",
   "mcpName": "io.github.mapbox/mcp-server",
   "main": "./dist/commonjs/index.js",
diff --git a/server.json b/server.json
index d645c91..4befc72 100644
--- a/server.json
+++ b/server.json
@@ -6,13 +6,13 @@
     "url": "https://github.com/mapbox/mcp-server",
     "source": "github"
   },
-  "version": "0.14.0",
+  "version": "0.15.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "runtimeHint": "npx",
-      "version": "0.14.0",
+      "version": "0.15.0",
       "identifier": "@mapbox/mcp-server",
       "transport": {
         "type": "stdio"