Skip to content

v2.17.4 — security housekeeping (2026-07-05)

Latest
Latest

Choose a tag to compare

View all tags
@tcconnally tcconnally released this 05 Jul 23:47
v2.17.4
985eec7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release shipping the 2026-07-05 review housekeeping (#461).

  • Removed the dead --workspace-token flag — it was documented as cross-workspace-access auth but no code read it (a control that looked active and wasn't). Transport auth is --mcp-token; workspace scoping is a routing control, not an enforced boundary (see docs/THREAT-MODEL.md). Passing --workspace-token now errors instead of silently no-op'ing.

See docs/security-review-2026-07-05.md.

Assets 13
Loading