Conversation
- Install vitest, add test/test:ci scripts and vitest.config.ts - 125 tests across 17 files covering core modules, CLI, and MCP - Add test step to CI workflow - Create update-homebrew.yml to auto-update I4cTime/homebrew-tap on release Made-with: Cursor
Made-with: Cursor
* feat: add Cursor marketplace plugin and update README/web with Homebrew + plugin info - Create cursor-plugin/ with plugin.json manifest, 3 rules, 4 skills, 2 agents, 5 commands, hooks.json, .mcp.json, and README - Add .cursor-plugin/marketplace.json at repo root for monorepo discovery - Update README.md with Homebrew install option and Cursor Plugin section - Add Homebrew tab to web Hero and docs install commands - Create CursorPlugin.tsx homepage section component - Add Plugin nav link, update Footer version to v0.9.4 - Add Cursor Plugin step to docs page - Remove beforeShellExecution hook (causes circular block with Cursor metadata) Made-with: Cursor * fix: resolve picomatch audit + update changelogs for v0.9.5 - Add pnpm override for picomatch >=4.0.4 (ReDoS + method injection) - Add v0.9.5 entry to CHANGELOG.md (Cursor plugin, Homebrew docs, audit fix) - Sync web changelog with v0.9.2–v0.9.5 entries Made-with: Cursor
Made-with: Cursor
- Single-pass regex replacer in parseDotenv() prevents double-unescape of backslash sequences (CodeQL js/double-escaping alert #14) - Add picomatch >=4.0.4 override to web/package.json (Dependabot #3, #5) - Remove stale package-lock.json + add to .gitignore (Dependabot #2) - Add 8 parseDotenv unit tests covering escape edge cases Made-with: Cursor
Made-with: Cursor
…gelog (#37) Replace plain <a> tags with Next.js <Link> for all nav items so /#hash links perform client-side navigation to / before scrolling to the target section, instead of looking for anchors on the current page. Made-with: Cursor
Made-with: Cursor
* security: OWASP full remediation for v0.9.8
- Extract SSRF guard into shared src/core/ssrf.ts, apply to validate.ts and provision.ts
- Fix shell injection in hooks.ts: spawn("pgrep") replaces exec("pgrep -f ...")
- Fix dashboard XSS: escape e.action in renderAudit
- Enforce checkKeyReadPolicy on listSecrets, exportSecrets, hasSecret, deleteSecret, getEnvelope
- Replace Math.random with crypto.randomBytes for tunnel IDs
- Store memory encryption key in OS keyring with legacy migration/fallback
- Escape regex metacharacters in glob-to-regex (server.ts, hooks.ts)
- Use word-boundary regex for exec profile denyCommands
- Add path-to-regexp and brace-expansion pnpm overrides
- Add CSP meta tag to web layout
- Add SSRF test suite (12 tests) and tunnel ID uniqueness test
- Version bump to 0.9.8, update CHANGELOG and web changelog
Made-with: Cursor
* fix: remove brace-expansion override — incompatible with minimatch@3 API
brace-expansion v5 breaks minimatch@3.1.5 (used by ESLint) which expects
the v1.x API. This is an upstream transitive dependency that cannot be
overridden without breaking the linter.
Made-with: Cursor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v0.9.8 — OWASP Security Remediation
Comprehensive OWASP vulnerability remediation addressing 11 security findings from SCA, SAST, and web security scans.
Security Fixes
src/core/ssrf.tsapplied to validate.ts and provision.tspgrepusesspawn()with argument array instead ofexec()renderAuditcheckKeyReadPolicyfor MCP sourcecrypto.randomBytes()replacesMath.random()denyCommandspath-to-regexp >=8.4.0Version Confirmation
package.json:0.9.8✓server.json:0.9.8✓Tests
Squash-merge recommended.
Made with Cursor