Repository navigation

Security fixes for 1.1.1 - #9

Merged

dennisdornon merged 22 commits into

mainfrom

fix/security-1.1.1

Jul 27, 2026

Merged

Security fixes for 1.1.1#9
dennisdornon merged 22 commits into
mainfrom
fix/security-1.1.1

Commits on Jul 26, 2026
- Fix the gating security findings from the pre-publish scan (1.1.1)
  dennisdornon
  committed
  3cb1430
- review fixes: self-review round (mask idempotency, surrogate-safe cap)
  dennisdornon
  committed
  578241c
- review fixes: codex adversarial round 1
  dennisdornon
  committed
  9623049
- review fixes: codex adversarial round 2 + coderabbit iteration 14
  dennisdornon
  committed
  58c7088
- review fixes: coderabbit iteration 15 (CI examples for the mandatory URL var)
  dennisdornon
  committed
  c2836d5
- review fixes: codex adversarial round 3
  dennisdornon
  committed
  7f92987
- Stop a URL authority from running through surrounding text
  dennisdornon
  committed
  94ad3f5
- review fixes: codex adversarial round 4
  dennisdornon
  committed
  4263383
- Leave an empty URL userinfo unmasked
  dennisdornon
  committed
  148e4a6
- review fixes: codex adversarial round 5
  dennisdornon
  committed
  c70da68
- Mask credentials on internationalized hosts
  dennisdornon
  committed
  3f15a6c
- review fixes: codex adversarial round 6
  dennisdornon
  committed
  805ed89
- review fixes: codex adversarial round 7
  dennisdornon
  committed
  1a097b9
- review fixes: codex adversarial round 8
  dennisdornon
  committed
  eab67e1
- fix url masking leaks found by differential fuzzing and review round 9
  dennisdornon
  committed
  e46ddde
- type the keytar interop shim instead of casting to any
  dennisdornon
  committed
  0b8ce40
- review fixes: codex adversarial round 10
  dennisdornon
  committed
  3a8abd7
- bound streamed tool calls and classify encoded url parameter keys
  dennisdornon
  committed
  a84dde3
- classify encoded url parameter keys in error messages too
  dennisdornon
  committed
  7c9ce6b
Commits on Jul 27, 2026

Navigation Menu

Repository navigation

Security fixes for 1.1.1 - #9

Security fixes for 1.1.1#9
dennisdornon merged 22 commits into
mainfrom
fix/security-1.1.1

Commits on Jul 26, 2026

Fix the gating security findings from the pre-publish scan (1.1.1)

review fixes: self-review round (mask idempotency, surrogate-safe cap)

review fixes: codex adversarial round 1

review fixes: codex adversarial round 2 + coderabbit iteration 14

review fixes: coderabbit iteration 15 (CI examples for the mandatory URL var)

review fixes: codex adversarial round 3

Stop a URL authority from running through surrounding text

review fixes: codex adversarial round 4

Leave an empty URL userinfo unmasked

review fixes: codex adversarial round 5

Mask credentials on internationalized hosts

review fixes: codex adversarial round 6

review fixes: codex adversarial round 7

review fixes: codex adversarial round 8

fix url masking leaks found by differential fuzzing and review round 9

type the keytar interop shim instead of casting to any

review fixes: codex adversarial round 10

bound streamed tool calls and classify encoded url parameter keys

classify encoded url parameter keys in error messages too

Commits on Jul 27, 2026

add 1.1.1 changelog entries and document the stream-cap layering

Pin brace-expansion to the patched 5.0.8 in the production tree

Mask sensitive URL parameters on the debug and doctor paths