v3.40.2

Security

• Hardened privileged RPC client recognition. The bundled-MCP and CLI allowlists now require source-qualified wire provenance, so an approved in-process UI plugin whose manifest name collides with a recognised host identity stays on its own declared permissions instead of inheriting the first-party method set. (GHSA-x2xm-9w7w-hh6p)

What's Changed

• chore(release): 3.40.2 by @openwong2kim in #843

Full Changelog: v3.40.1...v3.40.2