Skip to content

Spine v3.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Jul 22:04
v3.5.0
4e248cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔒 Security hardening

This release is a security baseline of Spine's own source — a description of the checks we now run and the issues we found and fixed, not a claim that the code is "secure."

  • CI on every PR: CodeQL (Python + JS), pip-audit over the locked dependency set, bandit-class linting, and Dependabot.
  • Multi-model adversarial self-review across the full tree — 7 confirmed issues fixed, each with a regression test: path traversal, an SSRF backstop gap, prompt-injection hardening in the review pipeline, and a web-UI stored XSS.
  • 17 of 18 dependency CVEs patched; the one remaining is unreachable and documented.
  • GitHub Actions pinned to commit SHAs (supply-chain hardening).
  • Coordinated disclosure: SECURITY.md.

Full details in CHANGELOG.md.

What's Changed

Other changes

Full Changelog: v3.4.0...v3.5.0

Contributors

nrohilla-fibonacci
Assets 2
Loading