Skip to content

Claude SEO v2.2.6: Security and Hosted Install

Choose a tag to compare

View all tags
@AgriciDaniel AgriciDaniel released this 10 Sep 15:01
· 64 commits to main since this release
v2.2.6
1d2299d

Claude SEO v2.2.6 is a security and hosted-install patch release.

Security

  • commoncrawl_graph.py no longer writes outside its cache directory: the --release
    value was interpolated raw into the cache filename, so --release ../../../../tmp/x
    escaped the cache directory and _save_cache wrote there. Malformed releases are now
    rejected at the CLI and path containment is asserted.
  • domain_history.py no longer follows an unvalidated WHOIS referral. The IANA
    refer: host is resolved and validated through url_safety and dialled at the
    pinned address; an unusable referral degrades to IANA's own answer.
  • url_safety.is_safe_ip now refuses the RFC 6598 shared address space
    (100.64.0.0/10), where Alibaba Cloud serves instance metadata, and judges
    IPv4-mapped IPv6 literals by their embedded address. This also refuses Tailscale
    addresses; see SECURITY.md.
  • WeasyPrint floor raised to 70.0 (PYSEC-2026-3940) and requests to 2.34.2
    (CVE-2026-25645). pip-audit passes.
  • SECURITY.md describes only reporting channels that exist: private vulnerability
    reporting is enabled and the unreachable email fallback is gone.

Added

  • The plugin installs from the claude.ai-hosted marketplace. Hosted sync rejects any
    plugin with a top-level bin/ directory, so the launcher moved to
    scripts/claude-seo and every skill, agent, and doc calls it as
    "${CLAUDE_PLUGIN_ROOT}/scripts/claude-seo" run <script.py>. Manual installs copy the
    launcher to ~/.claude/skills/seo/scripts/claude-seo and rewrite that token to the
    absolute path. A layout test keeps bin/ from coming back. Fixes #298 and #199.
  • CI runs the full suite on Windows and macOS, audits requirements.txt with
    pip-audit, and no longer swallows a failed dependency install in the v2 audit.
  • CLAUDE_SEO_CONFIG_DIR overrides the config and ledger location, so the ledger tests
    run against an isolated file. BANANA_HOME does the same for the Banana ledger.
  • preload_check.py --fail-under N turns the score into an opt-in gate.
  • Regression coverage for the backlink report validator, the schema-hook UTF-8 output,
    CRLF checkouts, PSI null category scores, ledger concurrency, the hosted plugin layout,
    and every ledger kind accepted by seo_updates.py.

Changed

  • Dependency floors raised by Dependabot: google-auth 2.56.2, courlan 1.4.0,
    playwright 1.62.0, numpy 2.2.6 (a major bump from 1.26; matplotlib moves to 3.9.0,
    the first line that supports numpy 2).
  • seo-technical treats dynamic rendering as a workaround to flag, not a target state,
    and recommends SSR, SSG, or CSR with a preferred-framework list.
  • The seo-backlinks skill and free-backlink-sources.md no longer contradict each
    other on Common-Crawl-only reports: no numeric score is produced, and
    validate_backlink_report.py fails a report that carries one.
  • The Repository Topology section of CLAUDE.md describes the two single-remote
    checkouts and the cherry-pick promotion flow actually in use.
  • The three test_sync_flow.py tests that call the live GitHub API run only when
    CLAUDE_SEO_NETWORK_TESTS=1; both CI test jobs set it with GH_TOKEN.

Fixed

  • The DataForSEO and Banana cost ledgers lost concurrent writes and could reset spend
    history after a truncated write. One exclusive lock now spans each read-modify-write,
    writes are atomic, Windows falls back to msvcrt, and a corrupt ledger fails closed.
  • pagespeed_check.py raised TypeError when a Lighthouse category returned a null
    score; the category is now skipped and the page is kept.
  • preload_check.py exited 1 on every successful run that scored below 75. A completed
    analysis exits 0. (#281)
  • consistency_check.py reported every FLOW-locked prompt as a hash mismatch on CRLF
    checkouts; it folds CRLF before hashing.
  • seo_updates.py --kind documentation was rejected by argparse while the ledger used
    that kind; the CLI and the schema now share one list.
  • Optional Google, Bing, and rendering dependencies missing at import time no longer
    abort the whole pytest session (pytest.importorskip in the affected modules).
  • The schema-hook tests decode the hook's UTF-8 output explicitly instead of through the
    locale codec, which is cp1252 on Windows.

Contributors

  • Tobi | Nordalux
  • Agrici Daniel
  • dependabot[bot]
  • Sergio
  • Adam Burgess
  • Nikolai V.
  • nicokeim1308
  • hwcgav
  • Claude

Install

curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-seo/v2.2.6/install.sh | bash

Full review behind this release: docs/REVIEW-full-2026-09-10.md (46 PRs and 17 issues tested at their exact heads).

Assets 2
Loading