v0.2.4

Security

GHSA-57x4-5jwm-2xg8 (#271): curate(..., constrained=True) interpolated caller SQL into a COPY statement, so a tenant could smuggle a second statement past the sandbox and run arbitrary DDL/DML on the connection. curate() now parses with extract_statements and refuses anything that is not exactly one SELECT.

Severity is Low. hflow serve, the only tenant-SQL surface shipped here, was never affected: its curation routes have always applied the same one-SELECT rule before any interpolation. Reaching the vulnerable path meant calling curate() directly from an integration without that guard. Even then the lockdown held everywhere it mattered, since constrained connections materialize the catalog in memory before the constraints land, so file access, ATTACH, extension loading, and the catalog's own files all stayed refused. What an attacker gained was arbitrary statements against a throwaway in-memory copy of data they were already permitted to query, on a connection closed at the end of the call.

Reported by @Raghav7-tech, who also wrote the fix.

Upgrade if you call curate(..., constrained=True) or open_catalog_connection(..., constrained=True) with SQL you did not write.

Note this narrows what curate() accepts: PIVOT is now refused, because DuckDB expands it into a CREATE plus a SELECT. DESCRIBE and SUMMARIZE now pass where they were previously parser errors.

Added

• First-class LeRobot v3 dataset import: hflow.import_lerobot_dataset and hflow import lerobot.
• DuckDB catalog UI.
• First-class model evaluation evidence.
• EgoSuite hand evaluation example, with natural sampling (#262, #270).
• hflow serve warns when it binds past loopback, since the server authenticates nobody (#269).
• camera_frame_stats reports <topic>/decode_deficit_pct: messages that arrived but did not decode, separate from the existing rate-based deficit. camera_frame_stats version 1 to 2 (#265).

Fixed

• LeRobot converter output decodes in full; B-frames disabled (#251).
• doctor chunk purity proxy checks the provenance group map (#252), and per-group chunk time order is enforced (#256).
• Egocentric contact-sheet enrichment resolves its camera explicitly (#253).
• Hand-count evaluation schema constrains its value set (#258).
• VideoEpisodeSpec refuses bools and non-finite numbers, matching its sibling validator (#277).
• Both evaluation examples refuse missing and malformed summaries with exit 2 instead of a traceback (#272, #290).

Tests

• Module boundaries are enforced mechanically: hflow.testing may not reach the canonical writer, and nothing under src/hflow/ may import hflow_server at module scope (#263).
• Malformed H.264 input guards, and the snapshot export symlink and null-episode_id refusals, are pinned (#282, #283).
• Five workspace and catalog refusal cases (#249).

Full changelog: v0.2.3...v0.2.4