Skip to content

v2.0.3 — Security and audit hardening

Choose a tag to compare

View all tags
@TheStreamCode TheStreamCode released this 08 Aug 19:03
· 6 commits to main since this release
v2.0.3
b265c86
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Restricts CHUTES_API_KEY to HTTPS chutes.ai and *.chutes.ai management and invocation URLs; custom and loopback management endpoints remain credential-free.
  • Bounds management JSON and HTTP error bodies using the configured response limit.
  • Replaces remaining catalog-controlled trailing-delimiter regexes with linear scans.
  • Refreshes vulnerable transitive URL, IP, middleware, and Nano ID packages.

Reliability

  • Bounds the short-lived model description cache.
  • Rejects invalid output-directory ancestors before a GPU invocation.
  • Keeps generated assets and provenance sidecars within portable filename limits.
  • Aligns CLI input limits with the MCP schemas.

Verification

  • 84 unit tests passed; 3 credit-spending live tests remained intentionally skipped.
  • CI passed on Node.js 20, 22, and 24.
  • CodeQL and npm audits passed with no open alerts.
  • The npm tarball contains the expected 13 files; isolated CLI and MCP handshake smoke tests passed.
Assets 2
Loading