Skip to content

Conduit v0.3.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jun 13:45
v0.3.5
709bd84

The hardening release. Conduit went through a thorough multi-perspective security, reliability, and UX audit, and this ships the fixes.

Security

  • Importing a shared setup now shows exactly what it will run (each server's command, args, and url) and imports only on your confirmation, flagging anything that spawns a shell. A shared config can no longer slip an unseen command past you.
  • OAuth endpoints discovered from a server's metadata are rejected if they point at a private or loopback address while the server itself is public (SSRF protection). Legitimate local servers are unaffected.
  • The app window now has an explicit Content-Security-Policy.

Reliability

  • Your registry is written atomically, so a crash mid-write can't corrupt your server set.
  • A corrupt registry no longer makes your tools silently vanish: the gateway keeps serving the last good tool list and logs the problem.
  • The catalog and config backups are stored in one consistent place across install types.

Polish

  • Onboarding's final step reflects what you actually set up and explains lazy discovery; the empty state offers a "Browse catalog" action; the New Profile dialog explains that profiles scope servers, not credentials.
  • Clearer macOS OAuth guidance, shown before sign-in rather than only after a failure.

Updating

v0.3.3 and later update in place (Windows, macOS, and Linux). Earlier versions: download below.

Assets 14
Loading