Skip to content

v3.63.2 — http_fetch SSRF guard fix

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 26 Oct 14:19
· 48 commits to main since this release
v3.63.2
a52ae16
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[3.63.2] - 2026-10-26

Patch release: @claude-flow/cli, claude-flow, ruflo 3.63.2. No leaf package published.

Security

  • http_fetch no longer lets IPv6 literals past its SSRF guard: brackets are stripped before matching, so the fc00::/7 and fe80::/10 checks now work, and IPv4-mapped forms such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 are decoded and checked against the IPv4 rules (#4503, #4504). Still open: ::, multicast and NAT64 ranges, and redirect re-validation.

Fixed

  • ruflo-console 0.49.4: the mission plan is submitted from a file, which fixes "command line is too long" on Windows (#4506).
  • CI gates helper sync on import and manifest checks (#4507).
Assets 2
Loading