Skip to content

v6.5.10

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 14:59
· 8 commits to main since this release
v6.5.10
This tag was signed with the committer’s verified signature.
AiKnox Knox with Transit AI
SSH Key Fingerprint: FWAjhWUioAnuQQd0F0L6dwcj5ASPV73eGAunEMqbdu4
Verified
Learn about vigilant mode.
7d76e1b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Certificate verification could accept distrusted intermediates.
    rustls-webpki 0.103.16 fixes RUSTSEC-2026-0382, where verification could
    accept a chain through an intermediate that should no longer be trusted.
  • The bundled root store still trusted distrusted emSign intermediates.
    webpki-roots and webpki-root-certs 1.0.10 fix RUSTSEC-2026-0381 and
    RUSTSEC-2026-0383.

Both sit under transit_tls, so they cover every HTTPS connection the app
makes: the direct calls to model providers that carry your API key, and the
REST device transport. Exploiting either would take a network attacker
holding a certificate from a distrusted authority; nothing suggests that has
happened, but certificate validation is not something to leave behind.
Dependency-only release: no source changes.

Assets 13
Loading