Skip to content

v0.4.31.3

Choose a tag to compare

View all tags
@patrick-chinchill patrick-chinchill released this 02 Sep 19:55
Immutable release. Only release title and notes can be modified.
v0.4.31.3
5d2fc3e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Same content as the 0.4.31.2 tag, which never reached PyPI (the publish action's pinned twine rejected Metadata-Version 2.5; fixed in #182) — Python-only fixes on top of 4.31.0 (UPSTREAM_PARITY unchanged at 4.31.0).

  • Teams: Graph SSRF / token-leak guard hardening (#178, security). call_teams_graph_api decided absolute-vs-relative URLs with a case-sensitive startswith("http"), so HTTPS://evil.example/x, mixed-case schemes, or scheme-relative //evil.example/x bypassed is_trusted_graph_url and had the Graph-scoped bearer token attached. Routing now uses the same scheme-insensitive parse as the allowlist; regression tests cover the mixed-case and scheme-relative forms.
  • Tests: the Teams skip-auth fixture survives the SDK's flag rename (#180).
  • Docs/licensing: NOTICE reproducing Vercel Chat's MIT copyright notice now ships in the sdist and wheel (#179).

Full notes: CHANGELOG.md.

Assets 3
Loading