Skip to content

Talos 0.19.20-alpha

Pre-release
Pre-release

Choose a tag to compare

View all tags
@morningstarnasser morningstarnasser released this 19 Sep 08:45
· 11 commits to main since this release
v0.19.20-alpha
9463084

Talos 0.19.20-alpha

This release makes browser actions check what they act on. An inspect receipt now carries a per-field guard — an element identity over the accessible state — and every mutating browser action accepts expect with that guard: if the element changed since it was inspected, the action is refused ("the observed element changed since it was inspected") instead of typing into or clicking whatever sits there now. A malformed guard is rejected by the contract before the browser is ever touched.

  • open navigates the existing Chromium tab instead of piling up a new tab per call. The stacked tabs stole focus from the very navigation meant to prevent them. Chromium is started once if it is not running, detached with setsid so the bounded run wrapper cannot kill it with the job.
  • The transitive pins are floored: anyio at 4.14.2 (GHSA-82r6-8w77-94w6, CVSS 9.3, and GHSA-5p39-cfhj-2xmp, CVSS 6.8), idna at 3.15 (PYSEC-2026-215, CVSS 6.9) and the development-only pygments at 2.20.0. The locked installs already carried the fixed versions; the requirement ranges claimed to tolerate the vulnerable ones, and an OSV scan resolves a range by its minimum.
  • README, changelog and website release metadata are aligned in the source tree.

Linux and macOS GitHub CI passed for this release commit.

Validation: 2,826 source tests collected (sanitized release source: 2,825 passed, 1 environment skip); 254/254 adversarial cases. OSV: no findings after the pin floors above. Archive signature verified; tampered bytes rejected. The full live-model 44-case E2E was not repeated: the change sits in the computer browser driver, which the E2E harness does not wire. The guarded path was proven in the VM against the installed driver instead (computer_browser_guard_e2e passed, op=browser over the API with HTTP 200).

The attached archive is signed with the existing Ed25519 release key. Verify its SHA-256 and signature as documented in SECURITY.md. Private profiles, credentials and operator data are excluded.

Published at https://talos-agent.ch. Website downloads match the signed GitHub assets byte-for-byte (HTTPS read-back, SHA-256 and Ed25519 verified); the site's status.json and installer now serve 0.19.20-alpha. Previous release downloads remain available.

Assets 5
Loading