Skip to content

v3.2.7

Choose a tag to compare

View all tags
@mrbro-bot mrbro-bot released this 25 Jul 20:44
· 396 commits to main since this release
v3.2.7
18ea18e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

Bug Fixes

security: brace-expansion is pinned to 5.0.8 via a package.json override, remediating GHSA-mh99-v99m-4gvg (CVE-2026-14257, High). Versions 5.0.7 and earlier have an unbounded expansion length that can crash the Node process with an uncatchable out-of-memory error from a roughly 7.5KB crafted input. The package reaches this repo only as a transitive dependency — pulled in via minimatch, which is required by markdownlint-cli, glob, and @earendil-works/pi-coding-agent, all devDependencies — so exposure was limited to local tooling and CI rather than runtime or published packages. (#694)

Also in this release

  • build: update OpenCode to v1.18.4 (#688)
  • deps: update fro-bot/agent to v0.95.0 (#693)
  • deps: update dependency @biomejs/biome to v2.5.5 (#692)
  • deps: update fro-bot/agent to v0.94.3 (#691)
  • deps: update ossf/scorecard-action action to v2.4.4 (#689)
  • deps: update bfra-me/.github to v4.16.40 (#686)
  • deps: update fro-bot/agent to v0.94.2 (#687)

Compare

v3.2.6...v3.2.7

Assets 2
Loading