Skip to content

0.7.9b3 安全维护预览版 / Security maintenance

Pre-release
Pre-release

Choose a tag to compare

View all tags
@aceddad aceddad released this 23 Oct 02:02
v0.7.9b3
414d28e

0.7.9b3 安全维护预览版 / Security maintenance preview

修复 npm 启动器可能复用旧 uv 的问题。此更新应对 GHSA-hq85-5cpj-mr62 所述的 emSign 证书信任事件。

  • PATH 中的 uv 低于 0.13.4 时，启动器改用固定版本 0.13.4 的下载／缓存；下载保留 SHA-256 验证。
  • 如果 LAYERWEAVE_UV 显式指定了过旧版本，则明确提示更新。
  • 中英文 README、MCP 和启动器说明同步了安全版本要求；PyPI 与 npm 介绍仍来自同一份文案。
  • 数据结构、Python 业务接口、网页资源和项目内容没有改变。

Fixes the npm launcher's reuse of outdated uv installations in response to the emSign certificate-trust incident described in GHSA-hq85-5cpj-mr62.

  • PATH copies older than uv 0.13.4 are skipped in favor of the pinned 0.13.4 download/cache, with SHA-256 verification retained.
  • An outdated executable explicitly selected through LAYERWEAVE_UV produces an update message.
  • Bilingual installation and MCP guidance now states the minimum patched versions.
  • Data structures, Python business APIs, web assets, and project contents are unchanged.

更新 / Update

使用 uv 路线前，先将 uv 更新到 0.13.4 或以上。/ For the uv route, update uv to 0.13.4 or later first.

uv tool install --upgrade --python 3.11 "layerweave[mcp]==0.7.9b3"

Windows x64、Node.js 20+ / Windows x64 with Node.js 20+:

npm install -g layerweave@0.7.9-beta.3

未全局安装时，也可以用 npx --yes layerweave@0.7.9-beta.3 demo 体验。MCP 客户端配置若固定旧版号，请改为新版并重启该 MCP 服务。已有项目继续保留修改。

You can also run npx --yes layerweave@0.7.9-beta.3 demo without a global installation. Update any version pinned in your MCP client configuration and restart that MCP service. Existing project edits are preserved.

升级 LayerWeave 不会升级其他 Python 环境。自行使用 pip 的环境仍须将 pip 更新到至少 26.2.2，已有的 certifi 更新到至少 2026.10.19。详见 Python Packaging 官方公告。

Updating LayerWeave does not update other Python environments. Environments using pip still need pip 26.2.2 or later, and any installed certifi should be 2026.10.19 or later. See the Python Packaging notice.

验证 / Verification

通过 wheel 普通安装、离线文章案例及保留修改、MCP auto/legacy、sdist 重建、npm 测试和包元数据检查。最终 npm tarball 实测了真实旧 uv 拒用、修复版接受、旧 PATH 版本回退及 MCP 调用。完整 Python 回归与浏览器复测已完成；两项 Windows 符号链接用例因权限跳过。

Verified ordinary wheel installation, the offline article starter and preserved edits, MCP auto/legacy modes, sdist rebuilding, npm tests, and package metadata. The final tarball was exercised with real old/patched uv binaries, fallback selection, and MCP. Python regression and browser rechecks completed; two Windows symlink tests were skipped for missing privileges.

附件与包索引使用同一批已验收文件，校验值见 SHA256SUMS。/ Release assets and registries use the same verified files; see SHA256SUMS.

Assets 6
Loading