fix(mcp): allowedorigins-removed message says v1.3.0, not v2.0.0

CHANGELOG.md

@@ -6,6 +6,12 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.3.1] — 2026-08-08
+
+Patch. Correct the `web.allowedorigins-removed` rule message and migration docs to name the
+
+real removal version: the field was removed in **v1.3.0** (breaking-in-minor), not v2.0.0.
+
 ## [1.3.0] — 2026-08-08
 
 Minor. Tracks the framework’s v1.3.0 removal of `web.Config.AllowedOrigins`.

README.md

@@ -1,6 +1,6 @@
 # einherjar/mcp
 
-[![version](https://img.shields.io/badge/version-v1.3.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/mcp)
+[![version](https://img.shields.io/badge/version-v1.3.1-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/mcp)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE)
 [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev)
 

cmd/server/main.go

@@ -23,7 +23,7 @@ import (
 
 const (
 	serverName    = "einherjar-mcp"
-	serverVersion = "v1.3.0"
+	serverVersion = "v1.3.1"
 )
 
 func main() {

internal/index/builtins/README.md

@@ -208,7 +208,7 @@ Whichever tier you pick, CORS origins always come from the framework var
 
 > **CORS has one home: `server.Config.CORSOrigins`.** In framework `v1.x`, `web.Config`
 > carried an `AllowedOrigins` field. It was env-backed through `v1.1.x` and a code-only override
-> in `v1.2.0` — reading it after the env tag moved silently served *no* CORS. **`v2.0.0` removed the
+> in `v1.2.0` — reading it after the env tag moved silently served *no* CORS. **`v1.3.0` removed the
 > field entirely** so the mistake fails at compile time instead of at runtime. If you are migrating
 > code that read `web.Config.AllowedOrigins` or set it in a struct literal, switch to
 > `cfg.Server.CORSOrigins`:
@@ -218,7 +218,7 @@ Whichever tier you pick, CORS origins always come from the framework var
 > //   mw.CORS(cfg.Web.AllowedOrigins)
 > //   web.New(logger, web.Config{AllowedOrigins: origins})
 >
-> // v2.0.0 — the single source of truth:
+> // v1.3.0 — the single source of truth:
 > mw.CORS(cfg.Server.CORSOrigins)                               // server.New tier
 > web.New(logger, web.Config{Server: cfg.Server})              // web.New reads it automatically
 > ```

internal/rules/cors_rules.go

@@ -29,12 +29,12 @@ func init() {
 // checkAllowedOriginsRemoved flags any reference to the removed
 // web.Config.AllowedOrigins field — both a selector (cfg.Web.AllowedOrigins) and a
 // struct-literal key (web.Config{AllowedOrigins: ...}). It was env-backed through
-// v1.1.x, became a code-only override in v1.2.0, and was removed in v2.0.0. Code
-// that still reads it compiled but silently served no CORS in v1.2.0; in v2.0.0 it
+// v1.1.x, became a code-only override in v1.2.0, and was removed in v1.3.0. Code
+// that still reads it compiled but silently served no CORS in v1.2.0; in v1.3.0 it
 // no longer compiles. CORS now lives solely on server.Config.CORSOrigins.
 func checkAllowedOriginsRemoved(c *Context) []Finding {
 	const (
-		msg  = "web.Config.AllowedOrigins was removed in v2.0.0 — CORS lives on Server.CORSOrigins (env EINHERJAR_SERVER_CORS_ORIGINS)"
+		msg  = "web.Config.AllowedOrigins was removed in v1.3.0 — CORS lives on Server.CORSOrigins (env EINHERJAR_SERVER_CORS_ORIGINS)"
 		hint = "Read cfg.Server.CORSOrigins (or set it in code); web.New applies it automatically. Never reintroduce a field/var for CORS origins."
 	)
 	seen := map[int]bool{}