Skip to content

Violin v2.0.6

Choose a tag to compare

View all tags
@Dan-StrategicAutomation Dan-StrategicAutomation released this 18 Jul 23:17
· 67 commits to master since this release
v2.0.6
2626e53
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Violin v2.0.6 consolidates six verified patch releases focused on security hardening, guard correctness, and maintainability.

Security

  • Upgraded pytest to 9.0.3 or later and locked pytest 9.1.1, addressing CVE-2025-71176 / GHSA-6w46-j5rx-g56g.
  • Restricted GitHub Actions workflow tokens to read-only repository contents.
  • Hardened compound raw-terminal command classification so target activity cannot be hidden behind pipelines, logical operators, semicolons, or newlines.
  • Blocked callback and research endpoints when supplied as primary assessment targets.

Guard reliability

  • Restored exact-repeat detection for receipt-backed execution history.
  • Added unambiguous command-length metadata while retaining compatibility with existing history records.
  • Made intentional exception fallbacks explicit and removed dead variables reported by CodeQL.

Verification

Every patch passed focused regression tests, Ruff lint and formatting checks, and the full python scripts\violin_guard.py check-release gate. The consolidated release passed lint, guard-check, and Violin CI in PR #24.

Issues #1, #2, and #3 were closed as completed through their individual patch PRs.

Full changelog: https://github.com/Strategic-Automation/violin/blob/v2.0.6/CHANGELOG.md
Compare: v2.0.0...v2.0.6

Assets 2
Loading