Skip to content

Noema v0.23.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Nov 23:48
v0.23.3
7af9c2c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Noema v0.23.3

This patch updates the TLS dependency to address four Rustls security advisories
and includes the reviewed dependency maintenance updates since v0.23.2.

Security

Rustls is updated from 0.23.45 to 0.23.46, fixing:

  • GHSA-h2v8-394m-p7vv: excessive allocation during Brotli certificate decompression before authentication.
  • GHSA-w44r-93j7-qv28: an unauthenticated ServerHello can poison the cached key-exchange hint.
  • GHSA-c8m5-c952-6cm4: session Debug formatting can expose TLS master secrets and resumption PSKs.
  • GHSA-vp88-798v-h67f: ECH rejection can expose buffered application data to the authenticated outer server.

Dependency Updates

  • MCP SDK (rmcp) 3.5.1, Tokio utilities 0.7.20, serde_json 1.0.154, and schemars 1.2.3.
  • Development dependencies: proptest 1.12.0, Obsidian API declarations 1.14.4, and Node declarations 26.6.5.
  • Rust 1.88 remains the minimum supported compiler. The Obsidian plugin's runtime minimum and production bundle are unchanged; its Moment security override is retained.

Upgrade

brew update
brew upgrade noema

Alternatively, install the matching platform archive from this release or
rebuild from the v0.23.3 source tag. Verify the archive against checksums.txt.
Then restart Noema servers and stdio MCP clients so they use the patched binary.
Updating the source lockfile alone does not patch an already-running process.

No Cortex data or configuration migration is required for this patch.

Qualification

The combined dependency updates passed Rust 1.88 formatting, strict Clippy,
full-suite tests with isolated operator configuration, and the evaluation
harness checks. Plugin tests, production build, and TypeScript checks passed.
Live smoke checks exercised stdio MCP discovery and errors, HTTP access-mode
guards, the Obsidian MCP client's trace lifecycle, and authenticated TLS
federation with CA, bearer, and plaintext-transport rejection checks. No real
Obsidian host UI smoke was performed; the production bundle is unchanged.

Full changelog: v0.23.2...v0.23.3

Assets 11
Loading