Skip to content

cmcp 0.7.1

Latest
Latest

Choose a tag to compare

View all tags
@imran-siddique imran-siddique released this 20 Oct 14:26
· 1 commit to release/0.7.x since this release
v0.7.1
4a7163a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Three security fixes, backported onto 0.7.0 so they ship without the breaking Agent Manifest binding change and the opaque provider removal waiting on main. Full detail in CHANGELOG.

  • GHSA-frxc-7f57-6f4r: deny a Cedar Allow that comes with evaluation errors, instead of skipping the errored policy and allowing.
  • GHSA-mrcx-xvv4-m7f8: bound the TPM AIA certificate fetch. Each hop resolves the host once, connects only to that checked address, and the hop and byte limits hold.
  • GHSA-2p85-666x-xm7x: classify upstream drift against the drifted tool's own catalog entry.

SDK on PyPI as cmcp-runtime 0.7.1.

Assets 5
Loading