Skip to content

v0.32.0

Latest
Latest

Choose a tag to compare

View all tags
@ibetitsmike ibetitsmike released this 24 Oct 02:31
v0.32.0
58374ec
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • The desktop app no longer decodes Brotli responses on its outbound requests. Its bundled Electron 44.5.1 runs Node 24.21.0, whose Brotli decoder has CVE-2026-111497 ("Node2Shell"), and its fetch decoded Content-Encoding: br responses from MCP servers, OAuth endpoints and provider base URLs. Requests now ask for gzip or deflate only, and a Brotli response is refused before it is decoded: a server that sends one anyway fails with "Refused a Brotli-encoded response (CVE-2026-111497)". The guard also covers xum server and ACP on a Node without the fix, and it turns itself off on a fixed Node. (#7374, #7358)
  • Still open: Vertex AI sign-in (google-auth-library) reaches Google's token endpoints through node-fetch, which decodes Brotli itself. The Electron bump in #7358 closes it.

Other changes

  • The renderer's entry chunk no longer bundles every tool schema (#7369).
  • Agent-loop refactors: more host and session file, lock, path, clock and process calls go through the host and session services (#7360, #7366, #7370, #7371, #7372, #7379).
  • Tests and CI: the bug-bash sandbox image moves to Node 22.23.4 (#7362), and the session lock and runtime contracts gain test layers (#7367, #7368, #7376).

Full changelog: v0.31.1...v0.32.0

Assets 35
Loading