[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Update	Change
ghcr.io/cbcoutinho/nextcloud-mcp-server	minor	0.199.4 → 0.202.1

---

Release Notes

cbcoutinho/nextcloud-mcp-server (ghcr.io/cbcoutinho/nextcloud-mcp-server)

v0.202.1

Compare Source

Fix

• contract: close GatewayProvider on the test's own event loop
• deps: pin mcp to 2.3.x for the streamable-HTTP session idle timeout

v0.202.0

Compare Source

Feat

• notes: add nc_notes_list_notes tool with a total count

Fix

• notes: drop semicolons from the list_notes description
• notes: keep list_notes count visible under truncation and bound its output

Refactor

• notes: validate list_notes limit and stream the count

v0.201.3

Compare Source

Fix

• ci: never cancel pact runs for master pushes

v0.201.2

Compare Source

Fix

• auth: stop reporting every failed AS-proxy refresh as invalid_grant

Refactor

• auth: drop _is_absolute_http_url from the AS-proxy refresh path

v0.201.1

Compare Source

Fix

• server: default serverInfo.version in NextcloudMCPServer itself
• server: advertise serverInfo.version in the MCP handshake

v0.201.0

Compare Source

Feat

• deck: refuse startdate/color on Deck < 1.18
• deck: support card startdate and color (Deck 1.18)

Fix

• deck: surface malformed card color as ToolError
• deck: drop semicolons from card tool descriptions
• deck: reject non-hex card colors

Refactor

• deck: extract _isoformat for date carry-over (Sonar S3358)

v0.200.5

Compare Source

Fix

• client: don't read a streamed request body in the request log hook

v0.200.4

Compare Source

Fix

• auth: store rotated refresh tokens with the IdP's lifetime (fixes #​411)

v0.200.3

Compare Source

Fix

• search: address review — error wording, label docs, pass-through tests
• search: fail fast when the query cannot be embedded, run bm25 keyword-only

Refactor

• search: bound the query embed with a context manager

v0.200.2

Compare Source

Fix

• http: merge caller headers via httpx.Headers in the factory
• client: send OCS-APIRequest from the httpx client, not per call site

Refactor

• webdav: hoist text/xml content type; document factory scope
• client: make NEXTCLOUD_DEFAULT_HEADERS read-only; clarify mail JSON headers

v0.200.1

Compare Source

Fix

• search: harden batched file verification per review
• auth: reject unparseable Basic headers with 401
• auth: verify multi-user BasicAuth credentials in the middleware

Perf

• search: verify file results per result instead of re-walking the tagged corpus

v0.200.0

Compare Source

Feat

• talk: filter talk_get_messages by thread
• talk: support creating and posting into Talk threads

Fix

• ci: keep release smoke test on Python 3.11 (project floor)
• ci: pin Python to 3.14 and cap Renovate below 3.15
• lint: satisfy ty 0.0.89
• talk: drop semicolon from talk_get_messages description
• talk: only map spreed's thread 404 to "thread not found"
• documents: read text inside Word content controls (w:sdt)

Refactor

• documents: split the docx block walk into helpers (cognitive complexity)
• talk: move thread 404 handling out of configure_talk_tools

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astrolabe-docs	Ready	Preview	Oct 26, 2026 11:07am UTC

[claude]

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 13s —— View job

---

Review: chore(deps): bump nextcloud-mcp-server e2e image

• Read the diff and CLAUDE.md
• Review the change

Change: tests/e2e/docker-compose.yml only. The mcp image goes from 0.199.4@sha256:4db2… to 0.202.1@sha256:b842…, and the digest pin is kept.

Observations

• The PR title and body say v0.201.2, but the commit and the file now say 0.202.1. Renovate updated the branch after the description was written (the head commit is chore(deps): … v0.202.1). The body's release notes stop at 0.201.2, so they miss 0.202.0 and 0.202.1. I did not review those releases because I can't see their changelog. Someone should skim them before merging.
• The jump covers several minors, 0.200 to 0.202. From the notes I could see, these look relevant to Astrolabe:
  • The auth changes (BasicAuth verification in the multi-user middleware, rotated refresh token lifetime, AS-proxy refresh errors). The e2e stack runs the MCP server with --oauth, so these touch the path under test.
  • The search changes (bm25 keyword-only fallback, batched file verification). Astrolabe's search integration consumes these.
  • serverInfo.version is now advertised in the handshake. This is additive.
• I did not find a breaking change in the notes I could see. Nothing here changes the /api/v1/* surface Astrolabe consumes through McpServerClient, and this PR adds no Astrolabe API surface. The mandatory e2e and Pact coverage gate therefore doesn't apply.
• Per CLAUDE.md, the e2e and Pact workflows run separately from ci.yml's summary gate. Confirm that e2e.yml passes on this PR before merging, because it is the only check that exercises the new image.
• The Pact consumer contract is not affected by this change. The consumer pact is generated from Astrolabe's own expectations, not from the server image.

Verdict: Looks fine to merge once e2e.yml is green. Update the PR description or let Renovate refresh it, since it still names v0.201.2.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud