Release v0.18.4 · HexRaysSA/ida-hcli

v0.18.4 (2026-06-30)

This release is published under the MIT License.

ipc: Match peer PID to the socket name; verify Windows pipe server (#231, e1597e6)
ipc: Only trust ida_ipc sockets owned by the current user (#231, e1597e6)
ipc: Scope IPC check to cross-user (uid), drop PID matching (#231, e1597e6)
ipc: Unpack SO_PEERCRED uid as unsigned (#231, e1597e6)
ipc: Verify peer uid at the connect chokepoint, not via lstat at discovery (#231, e1597e6)
protocol: Address re-review findings (uniform --, robust macOS log, error msg) (#230, 1195c92)
protocol: Harden ida:// handler registration (argv injection, temp log) (#230, 1195c92)
security-review: Post the report via gh pr comment (#233, c4bea69)

Automatic AI security review on PRs + review guidance (#232, 4a9f598)
Retry IDA install steps to ride out transient download 502s (#237, 335e792)
security-review: Always post a structured report comment (#232, 4a9f598)
security-review: Broaden review scope while keeping precision (#232, 4a9f598)
security-review: Broaden scope, lean report, one deterministic comment (#235, 3e8661d)
security-review: Clearer fallback message for workflow-editing PRs (#235, 3e8661d)

Make download navigation flow resilient to a slow/unreachable backend (#234, 302f3f5)
Skip the download navigation flow on EOF too (process exit), not just timeout (#236, 008b5c0)
ipc: Bind AF_UNIX sockets under a short /tmp dir (macOS path limit) (#231, e1597e6)
ipc: Make high-uid SO_PEERCRED test portable to macOS (#231, e1597e6)
protocol: Add type annotation for captured dict (mypy) (#230, 1195c92)
protocol: Cover the macOS/Linux artifacts; extract pure builders (#230, 1195c92)
protocol: Mock handler dispatch in arg-separator test (#230, 1195c92)

Detailed Changes: v0.18.3...v0.18.4