Skip to content

Title: Nexora Agent 1.3.1

Choose a tag to compare

View all tags
@sshdw sshdw released this 19 Sep 17:53
· 469 commits to main since this release
v1.3.1
ca441ec
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What

Security patch release: three hardening fixes on top of 1.3.0. No new features, no schema
changes, no migrations — a drop-in replacement.

Changes

  • Workspace guard widened (B-5). The agent workspace guard no longer covers only
    C:\Windows: %SystemRoot% on any drive, Program Files, Program Files (x86),
    ProgramData, Users, Windows.old, $Recycle.Bin, the Unix system trees, UNC paths and
    drive roots are all rejected. The stored root is re-canonicalized and re-checked on every use.
  • Strict production CSP (B-7). src-tauri/tauri.conf.json now ships a strict policy:
    script-src 'self' with no unsafe-inline and no unsafe-eval, plus object-src 'none'
    and base-uri 'self'. Development keeps a separate permissive devCsp, so npm run tauri dev
    is unaffected.
  • Attachment path validation (D-1). Attachment paths are validated in the backend: the path
    must be absolute, is canonicalized and stored canonical, protected system locations, UNC paths
    and drive roots are rejected, only existing regular files are accepted, and the stored path is
    re-validated immediately before the file is read.
File Size (bytes) SHA256
Nexora_1.3.1_x64_en-US.msi 6 995 968 163b68beffc39be4820dc8dedcdf875dea12fee0b6a2dcf6e2e3ddfbb3224d23
Nexora_1.3.1_x64-setup.exe 5 014 893 d74892a284d29d8a8a621fbf8cf09598dead696036d19befff8c36f101416e97

Compare link: v1.3.0...v1.3.1

Notes

  • No database migrations. Existing databases are untouched; the schema is still v6.
  • Base ca441ec (Merge PR #38). Tag v1.3.1 points at ca441ec (lightweight, as with v1.3.0).
  • Dev mode is unchanged: the strict CSP applies to production builds only.
Assets 4
Loading