Skip to content

v3.63.5 — http_fetch redirect validation, SONA EWC++ consolidation

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 27 Oct 19:12
· 52 commits to main since this release
v3.63.5
d635d42
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release: @claude-flow/cli, claude-flow, ruflo 3.63.5, plus standalone @claude-flow/neural 3.0.1.

Security

  • http_fetch now validates every redirect target, not only the first URL. A public URL can no longer redirect to loopback, private ranges, cloud metadata or file://. Redirects are capped at 10 hops, and Authorization/Cookie headers are dropped on cross-origin hops (#4534).

Fixed

  • SONA EWC++: SONAManager now records Fisher importance and anchor values after each learning cycle; before, they were always empty. The anchor is the parameter value at consolidation, so the penalty starts at zero (#4531, #4532, @claude-flow/neural 3.0.1). The penalty is still not applied to the learning update.
  • task_list status filter matches status aliases (#4536).
  • Workflow condition steps can read an earlier step's output via step-N.output (#4530).
  • task_summary counts cancelled tasks, so the counts add up to the total (#4489).
  • hooks_worker-status summary counts pending workers (#4529).
  • doctor recognizes matching npm launchers on Windows (#4473).
  • ruflo-console 0.49.5 keeps a project copy of the mission ledger, so a mission survives a restart that loads the console from a different source (#4524).
Assets 2
Loading