Skip to content

v1.9.0: MCP Isolation, JWT Revocation & Dependency Patches

Latest
Latest

Choose a tag to compare

View all tags
@sneg55 sneg55 released this 29 Sep 14:27
v1.9.0
f60cbdd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrade notes

  • WHATSAPP_WEBHOOK_SECRET is now required when ENVIRONMENT=production, whether or not WhatsApp is enabled. The backend refuses to start without it. Generate one with python -c "import secrets; print(secrets.token_hex(32))" and add it to .env before upgrading.
  • TRUSTED_PROXY_HOPS (default 1) controls which X-Forwarded-For entry the login throttle trusts. Set it to the number of proxies in front of the backend, for example 2 with Cloudflare proxying in front of Caddy.

Security

  • MCP server: the authenticated user is kept per SSE connection, so concurrent users can no longer read each other's contacts, interactions, suggestions and notifications (#164)
  • MCP standalone --sse server now requires an API key and binds 127.0.0.1 by default
  • X-Forwarded-For throttle bypass closed: client IP is read from the trusted-proxy side of the chain
  • JWT revocation: a password change invalidates every previously issued token
  • WhatsApp webhook fails closed when WHATSAPP_WEBHOOK_SECRET is unset
  • fastapi 0.115.0 -> 0.136.3, resolving starlette CVE-2024-47874, CVE-2025-54121, CVE-2026-48710, CVE-2026-48817
  • LLM-calling endpoints throttled; extension-scoped tokens rejected on optional-auth routes; ownership checked before merge status
  • extension https:/// host permission narrowed to a per-origin optional permission requested at pairing
  • pip-audit added to CI
  • two Dependabot sweeps (66 and 30 alerts) across frontend, landing, docs, whatsapp-sidecar and backend: next 16.2.7 -> 16.3.3 (two critical RCEs), axios, vitest, cryptography 48 -> 50, @puppeteer/browsers 3, joi, fast-uri, svgo, qs, postcss, js-yaml, undici, sharp

Fixes

  • CSV and LinkedIn Connections import keep the good rows when one row fails, and a successful import no longer crashes the UI (#165)
  • blank environment variables are treated as unset, so a fresh Docker Compose setup boots (#149)
  • /contacts filters and /organizations search work again after the page is loaded with a query string
  • pre-push hook lint step works with Next 16.3

Other

  • Ahrefs analytics on landing and docs sites
  • stale VERSION and CHANGELOG files removed; GitHub release notes are the changelog
Assets 2
Loading