Skip to content

v3.2.5

Choose a tag to compare

View all tags
@mrbro-bot mrbro-bot released this 22 Jul 01:01
· 403 commits to main since this release
v3.2.5
ab42f8a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

Bug Fixes

sharp is patched to ^0.35.0, resolving four inherited libvips vulnerabilities disclosed in GHSA-f88m-g3jw-g9cj (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591). Two of the four are rated High severity (CVSS 7.0) and affect anyone processing untrusted input through sharp prior to 0.35.0. The upgrade pulls in libvips 8.18.3, which tightens bounds-checking across several image operations (clahe, trim, recomb, extract, raw input dimensions) to prevent signed-integer overflow.

Documentation

Agent contract verification is now documented as a reusable learning: compile the real JSON Schema, validate emitted objects against it, and confirm that uncorrected live producer output is accepted by its existing consumer — rather than asserting against a mocked or simplified schema. The learning is cross-linked with adjacent contract-boundary and schema-validation guidance, and the v3.2.4 findings-contract plan is marked complete with its shipped provenance.

Also in this release

  • deps: Renovate bumped fro-bot/agent to v0.94.1 and github/codeql-action to v4.37.2.

Compare

v3.2.4...v3.2.5

Assets 2
Loading