Skip to content

v3.57.1 — env-denylist hardening + native bundle drift fix

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 19 Oct 17:05
· 107 commits to main since this release
v3.57.1
aedd3d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release: @claude-flow/cli, claude-flow, ruflo 3.57.1. @claude-flow/cli-core 3.7.4 (#4229, #4230) was published earlier and is pinned exactly.

Security

  • DENYLISTED_ENV_NAMES now blocks the credential/command-hijack and interpreter-flag-injection vars that 2026-09-21's env-sanitizer fix missed: GIT_ASKPASS, GIT_PROXY_COMMAND, GIT_CONFIG_NOSYSTEM, PERL5OPT, RUBYOPT, JAVA_TOOL_OPTIONS, _JAVA_OPTIONS, JDK_JAVA_OPTIONS, PYTHONHOME, CLASSPATH, PYTHONSTARTUP, plus git's numbered GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+) family via a new regex (cli-core 3.7.4, #4229, #4230).

Fixed

  • all-plugins-smoke: the adr/ddd/sparc codex-mod native hook bundles are rebuilt, clearing the native-bundle-drift failure that had been hitting every push to main; scripts/build-codex-mod-hooks.mjs also no longer hard-fails on Windows, where execFileSync can't invoke a .cmd shim directly (#4266, #4277, @uyg7x).

Contributors

uyg7x
Assets 2
Loading