gitlab-mcp-server 3.0.0 Tracks client-go to v3 and moves this module to /v3. Security: an HTTP deployment now refuses to start without an instance allow-list, the escape hatch is accepted only on a listener nobody else can reach, a cross-host redirect no longer carries the credential, and an outbound destination the operator did not choose is refused after DNS resolution. Creating a push mirror requires confirmation, and the token scope filter reaches the individual surface, where it removed nothing before. The field-by-field review against a booted GitLab published what the API sends and this server dropped, across the member, Geo, merge request and user families. The unprefixed environment names still work and are removed in 3.1.0, held one release because 2.7.5 updates itself into this one.