v3.4.9: Contain Yourself

This release backports security fixes from 4.1: OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.

What's Changed

Security 🔒

• [3.x] Backport OpenAPI dot-segment and skill containment fixes by @zzstoatzz, @GEONWOOHAN, and @avrlab233 in #5765
• [3.x] Bound regex tool search with Pydantic's regex engine and a time budget by @zzstoatzz and @SAYUTIM in #5768

Fixes 🐞

• [3.x] Share JWKS refreshes across key lookups by @zzstoatzz and @YuvalElbar6 in #5769

Docs 📚

• docs: credit contributors in v3.4.8 changelog entries by @jlowin in #5450
• docs: add v3.4.9 changelog entries by @zzstoatzz in #5772

New Contributors

• @avrlab233 made their first contribution in #5765
• @SAYUTIM made their first contribution in #5768
• @YuvalElbar6 made their first contribution in #5769

Full Changelog: v3.4.8...v3.4.9