Skip to content

session-peer v1.3.1

Choose a tag to compare

View all tags
@abruption abruption released this 26 Oct 23:40
Immutable release. Only release title and notes can be modified.
v1.3.1
5391365
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.3.1 maintenance release

Prepared on 2026-10-27 against published v1.3.0. These notes describe the source scope; check GitHub Releases and PyPI for publication records.

  • #338 / #339: update Node Control's transitive Zod dependency from 4.6.5 to 4.6.7 for GHSA-mrhx-c7xc-m3w5, which affects versions below 4.6.6. Direct dependencies and audit policy are unchanged. This addresses the locked dependency advisory; exploitability against deployed endpoints was not assessed or reproduced.
  • #334 / #335: include the byte-identical compatibility skill v0.4.0 from companion source 176dc0dab619f074dbfc94de7e01f9a02a052f79, SHA-256 debedd472e3b0c0c6844fb63f7fb2f17cb6c6cc8c3e981e9afd2531a35327af7. Minimum runtime remains 0.9.1; documented CLI coverage is 1.3.0; receiver codexBin still requires 1.0.1. The standalone release's skill asset does not update independently managed skill installations.
  • #336 / #337: show cumulative PyPI download counts in the four README variants.

Python CLI behavior, dependencies, supported platforms and experimental handoff limits remain unchanged from v1.3.0 apart from the version identifier. Node Control source is outside the Python wheel and sdist; publishing or installing the Python package does not remediate a running Control service. Applying the Node fix requires a separately authorized Control source/dependency update and restart.

Local verification of the dependency fix: clean npm installation, typecheck/build, 123 Control tests, 11 Node/Python loopback integration tests, and runtime/full npm audits with zero reported vulnerabilities. These are fixture results, not live OAuth, native-agent or deployed-service acceptance. Require final PR review, protected-main CI, dependency audits, reproducible artifacts and fresh installation checks before publishing.

Use a new v1.3.1 tag and verified immutable assets. Existing v1.3.0 assets remain unchanged. Native generation, handoff, storage and startup acceptance (#180/#181/#268/#304/#306/#307) and Side Session/steering research remain separate. Unknown delivery outcomes never authorize automatic resend.

Assets 10
Loading