Skip to content

v1.3.1

  • v1.3.1
  • 5ac6585

  • Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    GPG key ID: B5690EEEBB952194
    Verified
    Learn about vigilant mode

  • Choose a tag to compare

    View all tags
v1.3.1: chore(release): 1.3.1 (#347)
  • v1.3.1
  • 5ac6585

  • Choose a tag to compare

    View all tags

  • Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    GPG key ID: B5690EEEBB952194
    Verified
    Learn about vigilant mode
@rodloboz rodloboz tagged this 23 Oct 16:19 
* fix(deps): require req_llm 1.29 for its websocket tls fix (#346)

req_llm 1.28 and earlier don't verify the TLS certificate of their
WebSocket sessions (EEF-CVE-2026-107685, critical), which exposes API
keys and OAuth tokens to someone on the network path. Requiring ~> 1.29
keeps apps that use Lotus from resolving a vulnerable version.

Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit 99942901aece05bcd13e5ebc85b7bb25adf88f67)

* chore(release): 1.3.1

---------

Co-authored-by: Claude <noreply@anthropic.com>
Assets 2
Loading