Release v7.16.0

[github-actions]

What's Changed

New Features

• Add Cursor MCP support for global mode (Add Cursor MCP support for global mode #1273)
• Add git-config composite action

Bug Fixes

• Avoid YAML block scalars in Cursor frontmatter output (fix: avoid YAML block scalars in Cursor frontmatter output #1283)
• Fix git-client: use segment-based path traversal check and fix off-by-one in walk limits
• Fix git-client: add total file count and size limits to walkDirectory
• Fix git-client: anchor SCP-style URL regex to prevent trailing junk
• Fix git-client: validate skillsPath in fetchSkillFiles
• Fix git-client: validate ref returned by resolveDefaultRef
• Fix sources: add GitClientError hints in error handler
• Fix sources: use const for non-reassigned lock destructuring
• Fix sources-lock: validate resolvedRef as 40-character hex SHA

Improvements

• Improve git-client: use path.relative() in walkDirectory
• Deduplicate control character detection into shared validation utility
• Extract shared helpers from fetch functions in sources
• Add descriptions to source entry fields in JSON schema
• Expand git transport test coverage
• Centralize comment minimization in CI workflows

Contributors

Thanks to all contributors who made this release possible:

• @dyoshikawa
• @tmak (Thomas Marek)
• @wfscot (Scot Hastings)

Full Changelog

v7.15.2...v7.16.0