Skip to content

organic-os v0.5.2 - community fixes

Choose a tag to compare

View all tags
@shalintripathi shalintripathi released this 23 Jul 18:34
· 23 commits to main since this release
v0.5.2
a75e2da

Two reviewed outside contributions plus a small robustness fix. Both PRs were checked two ways in isolated worktrees - an independent correctness pass and an adversarial pass - before merge.

  • Inline code spans in the Monday report. Backtick-wrapped text (item ids and the like) now renders as code instead of arriving with literal backticks. The renderer escapes content before wrapping it, so a report carrying brain data stays injection-safe, and the tests assert the escaping itself. Contributed by AshSgDe29071999 in #18, closing #7.
  • DEL and C1 control characters are now rejected by sanitize_bot_token. The earlier guard caught control chars below 0x20 but missed DEL (0x7f) and the C1 range, so those could reach the request layer. Verified it cannot false-positive on a real token. Contributed by MasRama in #16, closing #15.
  • approval.find() no longer aborts on a malformed sibling brief file; the bad file is skipped and the scan continues.

Two follow-ups from the reviews are tracked as good-first-issues: a pre-existing link-renderer href injection (#19) and tightening the token guard to allow only printable ASCII (#20).

422 tests, 9 audit checks, 8 gate probes, CI green.

Assets 2
Loading