Repository navigation

fix(security): harden CLI against hostile-repository inputs and clear dependency advisories - #1835

Merged

clay-good merged 16 commits into

mainfrom

claude/openspec-security-review-ae70ed

Sep 16, 2026

Commits on Sep 10, 2026
- fix(deps): upgrade vitest to 4.1.11 and override fflate
  
  clay-good
  and
  claude
  committed
  7857094
- fix(core): bound schema size and stop prototype keys shadowing worksets
  
  clay-good
  and
  claude
  committed
  473a4b0
- fix(security): stop repo-supplied text forging agent instructions
  
  clay-good
  and
  claude
  committed
  a563b05
- fix(security): remove super-linear scans and tighten write containment
  
  clay-good
  and
  claude
  committed
  04cdd52
- fix(security): harden subprocess and shell-config write paths
  
  clay-good
  and
  claude
  committed
  181f465
- fix(security): pin the update check to TLS and honor telemetry opt-out
  
  clay-good
  and
  claude
  committed
  a988e12
- fix(security): make the close-tag escape linear
  
  clay-good
  and
  claude
  committed
  a4d9c59
- chore(nix): refresh pnpmDeps hash for the upgraded lockfile
  
  clay-good
  and
  claude
  committed
  1b3b86e
- fix(completions): quote the completions dir in printed instructions too
  
  clay-good
  and
  claude
  committed
  bff18c8
- fix(security): narrow envelope escaping to the tags that carry authority
  
  clay-good
  and
  claude
  committed
  e594269
- fix(security): repair four regressions the hardening introduced
  
  clay-good
  and
  claude
  committed
  47db9dd
- test: make the new security tests portable and discriminating
  
  clay-good
  and
  claude
  committed
  1becff1
- test: write the git probe fixture without exhausting file descriptors
  
  clay-good
  and
  claude
  committed
  780ffb4
Commits on Sep 15, 2026
- docs(instructions): correct a comment that claimed a dropped heading guard
  
  clay-good
  and
  claude
  committed
  f1b4125
- fix(archive): name the capability in the external-link warning
  
  clay-good
  and
  claude
  committed
  b4d3d4c
- fix(security): escape envelope tags split by line-break whitespace
  
  clay-good
  and
  claude
  committed
  085411e

Navigation Menu

Repository navigation

fix(security): harden CLI against hostile-repository inputs and clear dependency advisories - #1835

fix(security): harden CLI against hostile-repository inputs and clear dependency advisories#1835
clay-good merged 16 commits into
mainfrom
claude/openspec-security-review-ae70ed

Commits on Sep 10, 2026

fix(deps): upgrade vitest to 4.1.11 and override fflate

fix(core): bound schema size and stop prototype keys shadowing worksets

fix(security): stop repo-supplied text forging agent instructions

fix(security): remove super-linear scans and tighten write containment

fix(security): harden subprocess and shell-config write paths

fix(security): pin the update check to TLS and honor telemetry opt-out

fix(security): make the close-tag escape linear

chore(nix): refresh pnpmDeps hash for the upgraded lockfile

fix(completions): quote the completions dir in printed instructions too

fix(security): narrow envelope escaping to the tags that carry authority

fix(security): repair four regressions the hardening introduced

test: make the new security tests portable and discriminating

test: write the git probe fixture without exhausting file descriptors

Commits on Sep 15, 2026

docs(instructions): correct a comment that claimed a dropped heading guard

fix(archive): name the capability in the external-link warning

fix(security): escape envelope tags split by line-break whitespace