Skip to content

v2.20.1: security and data-loss hotfix

Choose a tag to compare

View all tags
@queelius queelius released this 25 Oct 06:41
· 5 commits to master since this release
v2.20.1
afbb219

Security and data-loss hotfix. Upgrade to 2.20.2, which closes gaps in two of these fixes (an OPENAI_API_KEY leak via the openai profile and --base-url, and read-only SQL/HTML media edge cases).

  • User SQL (execute_sql, ctk sql, /sql) runs on a fresh read-only connection with an authorizer; execute_sql no longer locks the database read-only and ? params work.
  • updated_at survives save/load/paging; timestamps normalized (migration 5).
  • HTML export XSS closed; crafted media references can't read files outside media/; conversation ids can't escape the export folder.
  • db init --force deletes only conversations.db; a broken config file is never overwritten.
  • TUI replies stay with the conversation that started them.
  • OPENAI_API_KEY is no longer sent to other profiles' servers (set <PROFILE>_API_KEY instead).
  • mcp pinned <2.
Assets 4
Loading