Skip to content

v3.56.4 — plugin-trust and helper security hardening, MCP/task fixes

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 11 Oct 01:08
· 13 commits to main since this release
v3.56.4
f6781f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release: plugin-trust and helper security fixes, MCP/task fixes, Node 24 sqlite fix.

Published: @claude-flow/cli, claude-flow, ruflo 3.56.4 (latest, alpha, v3alpha); leaves memory 3.0.4, integration 3.0.1, plugins 3.0.2, mcp 3.1.1, security 3.0.4.

Security: placeholder (all-zero) registry trust anchor no longer vouches (#3948); plugins upgrade no longer bypasses the install gate (#3951); plugin/helper locators stop at node_modules (#3986); session helper path and module-root hardening (#3949); helper CLI runs from the helper root, no shell interpolation of HELPER_ROOT (#3990); user-level settings pin home helpers (#3952); task_assign rejects proto ids (#3967).
Fixes: Node 24 better-sqlite3 abort (#3955); agentic-flow root import runs its CLI (#3958); MCP resource cache stale writes fenced (#4019); security scan code-pattern false positives (#3999); MCP/task/CLI fixes #3975 #3974 #3970 #3969 #3968 #3980 #3947; graph path search ~94x faster (#3977).

Full list: CHANGELOG.md.

Assets 2
Loading