Skip to content
This repository was archived by the owner on Aug 4, 2026. It is now read-only.

v3.3.1 — SSRF Consolidation & Security Fixes

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Jun 12:23
· 21 commits to main since this release
v3.3.1
0c44187

v3.3.1 — SSRF Consolidation & Security Fixes

Security

  • ARCH-03: sender_name now uses A2A_AGENT_NAME instead of hardcoded "britney"
  • NEW-01: REST POST /tasks/{id}:cancel now requires auth (was bypassing _check_auth())

SSRF Consolidation

  • 4 SSRF guard functions consolidated to 2 in security.py: validate_host and validate_target_url
  • Webhook delivery path now blocks private CIDRs (10.x, 172.16-31.x, 192.168.x)
  • All 11 call sites use one shared threat model via _is_private_ip

Commits

  • b9d0ea2: ARCH-03 sender_name uses caller identity + NEW-01 auth gate
  • a70e8a7: SSRF guards consolidated into security.py
  • ef69933: CancelTask REST tests fix

Full review cycle: a2a-v3.3-full-20260603

Assets 4
Loading