Skip to content

v2.50.24

Choose a tag to compare

View all tags
@blisspixel blisspixel released this 09 Oct 15:06
· 9 commits to main since this release
v2.50.24
64edc36
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening across A2A, MCP, auth, and logs.

Addresses security tracking issues 20 through 27:

  • Issue 20: added A2A connection semaphore, aggregate header phase deadline, and header line/byte caps.
  • Issue 21: enforced MCP global and per-owner subscription quotas, deduplication, and bounded SSE queue.
  • Issue 22: restricted route explanation to expert-scoped key allowlists.
  • Issue 23: throttled MCP PBKDF2 verification concurrency, keyed candidate lookup by prefix, and coalesced disk writes.
  • Issue 24: restricted dashboard session cookie acceptance strictly to portraits.
  • Issue 25: isolated Lemonade image requests from ambient proxies and redirects.
  • Issue 26: defended against regex backtracking, symlink escape, and skill prompt bloat.
  • Issue 27: sanitized sensitive tokens from scraping request and redirect logs.

Validation: CI on main 64edc367 passes. Python 3.12, 3.13, and 3.14 each pass 12,530 unit tests with 85.23% combined statement/branch coverage and independent 80% gates. Lint, strict types, code-health ratchets, documentation consistency, paid-boundary checks, core installation, plugin packaging, and CodeQL pass. All 87 frontend tests and synthetic browser checks pass. SHA256SUMS accompanies the three archives. No paid inference calls were made.

Detailed changes

Assets 6
Loading