Skip to content

v3.59.9 — toml CVE removal, Windows console path fixes, darwin 0.12.1 pickup

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 21 Oct 16:35
· 15 commits to main since this release
v3.59.9
588ef6b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Security: removed the unused toml dependency (unpatched high-severity CVEs) from @claude-flow/cli, root, and @claude-flow/codex — @iarna/toml was already the actual parser in use, so this was dead-code removal with zero functional change (#4357).
  • ruflo-console: fixed three related Windows path bugs — the ADR/export/transcript-save project-folder lookup rejected Windows drive-letter and UNC paths (C:\..., \\server\share) because the guard only checked for a leading /. Fixed with a proper cross-platform isAbsolutePath check, plus a path-reconstruction fix that no longer mangles a drive/UNC prefix with a bogus leading / (#4358, console 0.44.7).
  • Dependency pickup: @metaharness/darwin bumped to 0.12.1, picking up the upstream contrastive-deadline fix from ruvnet/metaharness#424 (published as part of this release cycle since the upstream merge hadn't been version-bumped yet) (#4359).

Notes

  • Full test suite showed pre-existing, unrelated intermittent flakiness in this release's worktree (commands.test.ts ordering flake — matches tracked #4307; embeddings-init-skipped-download-3376.test.ts traced to pnpm workspace-sibling symlink non-determinism for @claude-flow/embeddings, unrelated to either merged change). Neither touches @claude-flow/embeddings.

Verification

  • node scripts/audit-leaf-versions-published.mjs — all 4 non-bundled leaves (cli-core 3.7.5, neural 3.0.0, shared 3.0.5, memory 3.0.8) confirmed published.
  • pnpm -r build clean across all 24 v3 workspace packages.
  • All three packages (@claude-flow/cli, claude-flow, ruflo) confirmed on the live npm registry at 3.59.9, latest/alpha/v3alpha dist-tags updated.

🤖 Generated with RuFlo

Assets 2
Loading