release: integrate nightly-dev batch of 2026-09-02 - #319
Merged
Conversation
Hashview keys every hash lookup on md5(ciphertext) computed in Python
(utils.import_hash_only), so the comparison is case-sensitive regardless
of the column collation. It means to fold hex modes to lowercase on
import, but the guard reads `hash_type in ('300', '1731', '1000')` while
the upload route declares `<int:hash_type>` -- an int-versus-str compare
that is never true, so the API path stores whatever case arrived. The
web UI is unaffected because WTForms hands over a str.
Both consequences are silent: an uppercase hash misses the import-time
dedup (instacracked comes back 0), then the agent cracks it and reports
the ciphertext back lowercased, so the result lookup misses the
uppercase row and the plaintext is discarded with the hash left
cracked=0.
upload_hashfile now normalises each line before both the wire body and
the cache key. Only wholly-hex ciphertexts (optionally 0x-prefixed) under
one of nine raw-hex modes are folded, so bcrypt's $2B$, base64 digests
and the $DCC2$ marker are untouched. For user:hash only the field after
the first colon is folded -- the username is stored verbatim and feeds
the "(DYNAMIC) All Usernames" wordlist. pwdump is skipped because the
server lowercases the NT field itself.
The format gate compares as str so this fix does not repeat the very
int/str mistake it works around, and the line is decoded with
surrogateescape rather than errors="ignore" so a non-UTF-8 username
survives the round trip to the wire.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Follow-up to the case-folding fix, from review. Two defects in it: Decoding the line with errors="surrogateescape" fed lone surrogates to hashview_cache.cache_key, whose strict UTF-8 encode rejects them -- so a username with a non-UTF-8 byte aborted the whole upload with an unhandled UnicodeEncodeError. Normalization now runs on bytes, where lowercasing ASCII hex needs no decoding at all. Separately, and pre-existing: the skip-list key decoded with errors="ignore", which drops the offending bytes, so two accounts differing only there collapsed onto one cache key and the second was silently skipped as already uploaded. The key now decodes with latin-1, which is injective over bytes and always re-encodes cleanly. ASCII lines decode identically either way, so existing entries are unaffected. Also adds a hex-shape test under a listed mode (MySQL's *-prefixed native form under 300); the previous test used bcrypt, which the mode gate rejects first, so the hex gate had no test that killed it. Verified by mutation: dropping the regex, the .lower(), the format-4 split, the str(file_format) coercion, or reordering the key derivation each turns the suite red. The pwdump exclusion does not, and both the comment and the test now say so rather than implying coverage that is not there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A race in the notification system's startup sequence caused a line written to the `.out` file between start() returning and the thread's first execution to be silently dropped. The background thread called _seek_to_eof() on entry to run(), creating an unbounded window where new cracks are measured as pre-existing and never notified. Move the seek into start() so it runs synchronously in the caller's control flow. In run(), guard the call with `if self._file_pos is None:` to preserve the fallback for direct run() invocation while preventing a double-seek that would reintroduce the same race downstream. Surfaced by Dependabot PR #317's CI failure on a starved runner. The test `test_no_username_falls_back_to_attack_name` randomly won/lost this race depending on scheduling. The race is unrelated to the atomic-agents bump. Two new regression tests confirm the fix: - test_start_seeks_to_eof_synchronously: parks the thread and asserts _file_pos is set before it runs - test_line_written_immediately_after_start_is_not_swallowed: simulates thread starvation and verifies notification fires Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Consolidates PRs #315, #316, #317, and #318 into a single commit and lock, following the pattern established by prior commit e394e80. No lock file committed (uv.lock is gitignored). Note on PR #317 (atomic-agents bump): The CI failure reported on that PR was not caused by the atomic-agents version bump. It failed on a pre-existing race condition in hate_crack/notify/tailer.py (CrackTailer seeking EOF on the wrong thread), which was fixed separately on branch fix/tailer-seek-race and merged before this task began. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Consolidates PR #314, a dependency bump in the release workflow action. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Rename the [Unreleased] section to [2.36.1] - 2026-09-02 ahead of the batch integration merge into main. tools/next_version.py --channel stable reports v2.36.1: the batch carries only fixes and chores (the CrackTailer start-race fix, two Hashview upload-casing fixes, and a Dependabot consolidation), so the patch moves rather than the minor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
No open issues to close in this batch — all CHANGELOG entries reference PR numbers, not tracked issues.
Test plan
git merge --ff-only nightly-devfrommain), not the GitHub button