einherjar/mcp
2
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

fix(mcp): allowedorigins-removed message says v1.3.0, not v2.0.0

Browse Source
This commit is contained in:
Rene Nochebuena
2026-08-08 14:07:39 -06:00
parent 3961ae7175
commit e1802e4c25
6 changed files with 10813 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/rules/cors_rules.go
+3 -3
View File
@@ -29,12 +29,12 @@ func init() {
// checkAllowedOriginsRemoved flags any reference to the removed
// web.Config.AllowedOrigins field — both a selector (cfg.Web.AllowedOrigins) and a
// struct-literal key (web.Config{AllowedOrigins: ...}). It was env-backed through
// v1.1.x, became a code-only override in v1.2.0, and was removed in v2.0.0. Code
// that still reads it compiled but silently served no CORS in v1.2.0; in v2.0.0 it
// v1.1.x, became a code-only override in v1.2.0, and was removed in v1.3.0. Code
// that still reads it compiled but silently served no CORS in v1.2.0; in v1.3.0 it
// no longer compiles. CORS now lives solely on server.Config.CORSOrigins.
func checkAllowedOriginsRemoved(c *Context) []Finding {
const (
msg = "web.Config.AllowedOrigins was removed in v2.0.0 — CORS lives on Server.CORSOrigins (env EINHERJAR_SERVER_CORS_ORIGINS)"
msg = "web.Config.AllowedOrigins was removed in v1.3.0 — CORS lives on Server.CORSOrigins (env EINHERJAR_SERVER_CORS_ORIGINS)"
hint = "Read cfg.Server.CORSOrigins (or set it in code); web.New applies it automatically. Never reintroduce a field/var for CORS origins."
)
seen := map[int]bool{}