Skip to content

v0.3.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Oct 15:17
· 2 commits to main since this release
v0.3.1
This tag was signed with the committer’s verified signature.
JairoTorregrosa Jairo Torregrosa
SSH Key Fingerprint: 4IhHPl/iGVYCJu06sW/eu+rGwzhTQZpbsRnpNJbs73s
Verified
Learn about vigilant mode.
8633970
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

askcodex 0.3.1 is a dependency-only security patch. It has no CLI, output or behavior changes compared with 0.3.0. Upgrade if you use the v0.3.0 binaries, which link rustls 0.23.43.

Security fixes (bundled TLS stack)

Crate 0.3.0 0.3.1 Advisories fixed
rustls 0.23.43 0.23.46 GHSA-2mjx-qc3c-rqvc (medium): TLS 1.3 handshake messages accepted across encryption-level boundaries · GHSA-c8m5-c952-6cm4 (medium): session Debug formatting exposes TLS secrets · GHSA-w44r-93j7-qv28 (low): an unauthenticated ServerHello can downgrade later key-exchange shares to classical X25519 · GHSA-h2v8-394m-p7vv (low): Brotli certificate decompression memory (the Brotli feature is not enabled in askcodex)
rustls-webpki 0.103.13 0.103.16 RUSTSEC-2026-0382: certificate paths through distrusted emSign intermediates
webpki-roots 1.0.9 1.0.10 RUSTSEC-2026-0381: bundled roots allowed the distrusted emSign intermediates

h2 also moved 0.4.15 → 0.4.16 (RUSTSEC-2026-0258). It is a test-only dependency (httpmock) and is not in the binary.

Also since 0.3.0

  • The skill's text-prompting reference defines its extraction example's fields and null policy (#17). It is installed only with ./install.sh --skills ..., and the binary does not change.

What's Changed

  • fix(deps): patch rustls and TLS root advisories in Cargo.lock (#19)
  • docs(skill): the extraction example defines its fields and null policy (#17)
  • chore(release): askcodex 0.3.1 (#20)

Binaries are built with --locked from the tagged commit. Verify the archive against SHA256SUMS before you install it.

Full Changelog: v0.3.0...v0.3.1

Assets 7
Loading