Skip to content

v0.12.0 — security hardening, dashboard rebuild, dependency patches

Choose a tag to compare

View all tags
@I4cTime I4cTime released this 25 Jun 05:27
v0.12.0
72bd6b7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔒 Security hardening

  • export_secrets honors the requiresApproval gate on bulk MCP reads
  • Governance policy anchored to the MCP server's launch directory (no projectPath escape)
  • import_dotenv over MCP no longer reads arbitrary files (content-only)
  • SSRF: connect-time re-validation closes the DNS-rebinding window
  • Teleport PBKDF2 100k → 210k (legacy bundles still decrypt)
  • Status dashboard endpoints require a per-launch token
  • Hardened exec network/command guards; policy cache invalidates on .q-ring.json change

📊 Dashboard

  • Rebuilt on Preact + htm with VDOM diffing — fixes the flicker/reload-on-update; still a single self-contained, offline page

📦 Dependencies & CI

  • Cleared 23 Dependabot alerts; pinned pnpm via packageManager; added Dependabot config + PR template

⚠️ Breaking

  • Dashboard returns 403 without its token (use the printed URL)
  • A single MCP server now applies only its launch directory's .q-ring.json policy

Full notes: CHANGELOG.md

Assets 2
Loading