v2.1.1 release notes

Highlights

Security housekeeping. Every open code-scanning alert on master is dispositioned — 8 fixed in code, 47 dismissed with recorded reasons — and the dead web-app tree that accounted for six of them is gone from the repository and from the runtime image.

No behaviour change for anyone using the MCP server. Two npm scripts now do what their names promise.

	before	after
Open code-scanning alerts	55	0
Security-severity alerts live in the shipped image	6	0
Files under src/web/ in the runtime image	8	0
npm run build	invoked a build broken since v1.7.1	generates the operation config
npm start	invoked a build broken since v1.7.1	runs the MCP server

Why 55 alerts appeared after v2.0.0 reported zero

The v2.0.0 notes said “zero open code-scanning alerts”, and that was true where it was measured — immediately before the release merge, both alert APIs returned 0.

A pull-request CodeQL run analyses the merge commit in a diff-informed mode. The push to the default branch runs a full analysis. When v2.0.0 merged, CodeQL ran fully against master for the first time in months and surfaced 55 pre-existing findings.

None were introduced by v2.0.0 — they are older than the release that surfaced them. The lesson worth keeping, and now recorded in the v2.0.0 notes, README and ROADMAP: “zero alerts” measured on a PR is not the same claim as “zero alerts on the default branch.”

Fixed: src/web/ was dead — and shipping

Six alerts, three of them high severity (js/remote-property-injection ×2, js/missing-origin-check ×4), all in browser Web Worker postMessage handlers.

The web application was removed in v1.7.1, but eight files survived. Established before deleting anything:

• Nothing imports them — no reference anywhere under src/node/ or src/core/.
• The build they belong to cannot run. src/web/index.js imports ./stylesheets/index.js, which does not exist; nor do html/index.html or static/ga.html. Confirmed by running it: grunt prod failed with 39 webpack errors, and had since v1.7.1.
• They shipped anyway — find /app/src/web -type f in the published v2.1.0 image returned all eight, because the Dockerfile’s prune list never named src/web.

Dead browser code carrying three high-severity findings was being copied into a server image nobody could reach it from. Deleted, not suppressed.

Fixed: npm start and npm run build

Both were mapped to the removed web build — the two most conventional script names in any JS project, pointing at something that had not worked since v1.7.1.

npm start      -> npm run mcp                (runs the server)
npm run build  -> npx grunt configTests      (generates OperationConfig.json + src/node/index.mjs)

grunt configTests genuinely is this project’s build step: every CI job, the Dockerfile and the documented setup already run it. The retired grunt dev / grunt prod tasks now exit non-zero with an explanation rather than printing a message and reporting success — a build command that does not build must not report success.

Fixed: benchmarks allocated 11 MB per run

testData1MB and testData10MB were declared and never used, and "A".repeat() builds eagerly. Also corrected the file’s @license Apache-2.0 header, wrong since the v2.0.0 relicense and the only fork-owned file still carrying it against 62 that were correct.

Dismissed: 47, with reasons

Recorded in docs/security/2026-08-31-code-scanning-disposition.md, and every dismissal comment points at it.

Count	What	Why
44	src/core/vendor/** — GOST crypto, x86 disassembler	Code-quality rules, none with a security severity, in files byte-identical to upstream v11.4.0. A hand-edit to a mirrored file is silently reverted by the next sync — documented history here, not theory. Collected for upstream report in #73.
1	src/core/ChefWorker.js	The web app’s Worker entry point; nothing in src/node/ references it. The flagged line is upstream’s. Not deleted, unlike src/web/, because this file is on the sync allowlist.
1	src/core/config/scripts/newOperation.mjs	Developer scaffolding for npm run newop, byte-identical to upstream, verified absent from the runtime image.
1	src/core/operations/FromBCD.mjs	A live operation, byte-identical to upstream. A real if minor correctness smell — reported upstream rather than patched here.

Of the eight alerts carrying a security severity: six fixed by deletion, two dismissed on reachability. None is suppressed while remaining live in the shipped product.

Upgrading

docker pull ghcr.io/doublegate/cyberchef-mcp_v2:latest

Nothing to change. If you invoked npm start or npm run build from this repository, they now do something useful instead of failing.

Verification

npm run lint                 0 errors
npx vitest run tests/mcp/    805 passed (26 files)
tests/operations             2289 passed
tests/node                   241 passed
docker build                 ok; /app/src contains only core and node
open code-scanning alerts    0
open dependabot alerts       0

---

Full Changelog: v2.1.0…v2.1.1