Skip to content

mpai 0.4.10 — security hardening

Choose a tag to compare

View all tags
@godfaddaai godfaddaai released this 03 Aug 08:21
· 21 commits to main since this release
v0.4.10
6f3b63d

Public-alpha security hardening for the invite-authentication boundary.

Fixed

  • Bearer authorization parsing is length-bounded and accepts only the generated invite token alphabet.
  • The attacker-controlled polynomial regular-expression path reported by CodeQL is removed.
  • Oversized, malformed, and non-Bearer credentials are regression-tested while valid generated invites still work.

Install

brew install godfaddaai/tap/mpai
# exact Node.js fallback
npm install --global https://github.com/godfaddaai/multiplayer-ai/releases/download/v0.4.10/multiplayer-ai-0.4.10.tgz

Proof

  • Full suite: 44/44 tests on Node 20 and Node 22 in CI run 30796935452.
  • CodeQL extended scan run 30796935472 completed successfully with zero open alerts.
  • Exact release asset SHA-256: 4a0ddb1fbe72175272cd0beabb7ac7247473ac06fb49fe1be5d42eedce57a79c.
  • The tag and artifact are built from commit 6f3b63d7f46d28a9fefb836738db6a64b9ed4dbd.
  • Isolated GitHub-asset install reported 0.4.10 from both mpai and multiplayer-ai.
  • Homebrew run 30797200745 installed, executed, tested, uninstalled, and removed both CLI links on clean macOS 26 and Linux.
  • Reagan and Hudson upgraded their existing prefixes and restarted matching 0.4.10 services; reciprocal shared-session reads remained intact.
Assets 3
Loading