Skip to content

v0.24.3 — SSRF mapped-IPv6 + thinking-budget floor

Choose a tag to compare

View all tags
@VickyXAI VickyXAI released this 29 Jun 00:09
v0.24.3
05de375

A fourth audit pass (regression-hunting the 0.24.1–0.24.2 fixes + packaging/build) found two issues, both in fixes shipped earlier in the 0.24.x line.

  • fix(security) — the image SSRF deny-list (added in 0.24.1) only decoded the decimal ::ffff:127.0.0.1 form, but the URL parser canonicalizes mapped literals to hex (::ffff:7f00:1), so http://[::ffff:169.254.169.254]/ reached cloud metadata and [::ffff:127.0.0.1] reached loopback. The hex ::ffff:hi:lo form is now decoded and blocked; the test exercises the hostname new URL() actually emits.
  • fix(chat) — thinking.budget_tokens floor raised to 1024 (Anthropic's minimum); the prior floor of 1 meant [1,1023] always 400'd.

72 unit tests. Full details in CHANGELOG.md.

Assets 2
Loading