Skip to content

v2.24.0

Choose a tag to compare

View all tags
@blisspixel blisspixel released this 24 Oct 08:44
· 39 commits to main since this release
v2.24.0
7f3a9cd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

Added

  • Recognize Vercel's documented nonempty verification marker at _vercel.
    Invite contributors interested in catalog validation, independent review,
    and a possible future maintainer role through the contribution guide.

Fixed

  • Exclude mail controls made inapplicable by retained Null MX declarations
    from hardening prompts, review candidates, and index allocation. Require
    explicit deny-all SPF and effective DMARC enforcement before excluding
    sender controls, retain declaration proof, and preserve applicability in
    hypothetical simulations.
  • Adapt boxed gap, exposure, and delta reports to up to 100 columns with
    hanging continuation indents and whole identifiers. Keep the ASCII help
    example visible and link sparse-result guidance for installed users.
  • Report the checked MCP server's DNS capability in both doctors with an
    actionable warning when no caller-safe view is approved. Refuse unavailable
    collection before reserving rate limits, and advertise and enforce the
    chain-depth range without silently changing caller requests.
  • Canonicalize merged evidence before interpretation so shuffled DNS answers
    do not create false capsule changes. Preserve literal www hosts with
    --exact, retain balanced CAA record quotes, and normalize CT issuer display
    labels across provider and cache paths. Record normalizer version 2 while
    keeping historical capsule artifacts intact.
  • Label caches bound to another DNS policy as non-reusable metadata rather
    than inspection failures, while keeping their payloads inaccessible to the
    current view. Reject empty CT metadata as an offline recovery contribution
    so fully failed lookup and review workflows exit 4.
  • Share CNAME DNS-label and regex matching between fresh detection and cached
    replay so cached records cannot gain a provider claim from a lookalike.
    Narrow Fly.io, Railway, and Netlify targets to their documented routing
    boundaries, date ten reviewed rules, and distinguish routing and published
    verification markers from completed verification or active deployments.
Assets 6
Loading