On 2026-10-22, mcp-acronym-lookup v0.4.5 was published. This release is a security rebuild with no functional changes to the server itself. The pre-compiled binaries have been rebuilt with a patched Go toolchain to address the compromised eMudhra intermediate CAs referenced in GO-2026-6809 / CVE-2026-111943. For users running the official binaries, upgrading ensures the toolchain’s trust store no longer relies on the compromised certificates. Configuration, CSV format, CLI flags, and lookup behavior remain identical to v0.4.4.

What’s new

v0.4.5 contains no user-visible feature changes. The server code in main.go and main_test.go is unchanged from v0.4.4, and the ACRONYM_FILE configuration and --http transport options work exactly as before.

The meaningful update is the binary rebuild:

  • Official release assets for macOS amd64/arm64, Linux 386/amd64/arm64, and Windows 386/amd64 were rebuilt with Go 1.27.3 as noted in the release notes.
  • The rebuild addresses GO-2026-6809 / CVE-2026-111943 by distrusting the compromised eMudhra intermediate CAs in the Go toolchain’s certificate store.
  • The commit range v0.4.4..v0.4.5 updates CI workflows and dependencies only, with no source changes. This includes a fix for govulncheck SARIF upload deduplication and routine dependency bumps.

There are no breaking changes and no configuration changes required.

Why it matters

mcp-acronym-lookup provides a lightweight, configuration-driven MCP server for acronym lookup from a CSV source. While the lookup logic is unchanged, the security of the distribution chain matters for users who install the pre-compiled binaries. Rebuilding with a Go release that distrusts the compromised eMudhra CAs reduces risk associated with TLS verification performed by the Go toolchain during builds and any runtime certificate checks. It is a maintenance release focused on supply-chain hygiene rather than new capabilities.

For users who build from source with go install, the source is identical to v0.4.4. The security benefit applies specifically to the official release binaries built with the patched toolchain.

Upgrade

If you use the official binaries, upgrade from v0.4.4 to v0.4.5 to obtain the rebuilt assets. Downloads and checksums are available on the GitHub release page for v0.4.5: https://github.com/UnitVectorY-Labs/mcp-acronym-lookup/releases/tag/v0.4.5

No configuration changes are needed. The server continues to read acronyms from the file specified by ACRONYM_FILE and exposes the same lookup tool to MCP clients.

Transparency note: This post was AI-generated by the model unsloth/Muse-Glimmer-30B-GGUF:Muse-Glimmer-30B-UD-Q6_K_XL on 2026-10-22. It references repository UnitVectorY-Labs/mcp-acronym-lookup, release v0.4.5 published 2026-10-22. Author: release-storyteller.