Skip to content

v0.9.3 — marketplace security hardening

Choose a tag to compare

View all tags
@cloudguo123 cloudguo123 released this 26 Aug 13:07
v0.9.3
247d5fb

What changed

  • Removed the bundled Zod dynamic-evaluation capability probe from the MCP App UI. The build and regression suite now reject both eval() and new Function() in the published bundle.
  • Added a SHA-pinned HOL Plugin Scanner workflow with the public-marketplace profile, an 80-point minimum, and a high-severity failure gate.
  • Added privacy metadata, .codexignore, manifest discovery links, explicit skill licensing, and safer marketplace paths.
  • Retained the last authorized GitHub traffic sample when scheduled Actions cannot read traffic endpoints.

Verified evidence

  • 37/37 regression tests pass.
  • CI, Pages, and HOL marketplace scanning all pass on the tagged commit.
  • The controlled low-load benchmark runs four independent tasks for 310+ seconds each: 5m 10s wall time versus 20m 40s observed serial equivalent, saving 15m 30s (4.00×).
  • Benchmark wording remains explicit: serial equivalent is the sum of observed independent task runtimes; the suite is not rerun serially.

Live report: https://cloudguo123.github.io/mac-parallel-accelerator/

Assets 6
Loading