·
1 commit
to main
since this release
Immutable
release. Only release title and notes can be modified.
Security
- Fixes an SSRF guard bypass in which the IPv6 unspecified address
::could reach services listening on IPv6 loopback. IPv4 and IPv6 unspecified addresses, including expanded IPv6 spellings, are now rejected by the shared address classifier and URL guard. - Affected versions:
<= 2.27.0. - Patched version:
2.28.0. - Advisory: GHSA-gc4h-hj7x-gp5p.
Highlights
- Adds generic management for
flyto-modules-*andflyto-plugin-*extensions, with authenticated install/uninstall routes, entry-point verification, rollback for failed new installs, and explicit restart requirements. - Strengthens plugin policy checks, lifecycle synchronization, registry snapshot consistency, and capability-manifest refresh behavior.
- Keeps the generated tool catalog independent of locally installed third-party extensions.
Upgrade with:
python -m pip install --upgrade flyto-core==2.28.0See the changelog for the full release details.