5dive

v0.9.13 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agent-runtime agentic-engineering agentic-loops agents ai-agents ai-assistant

+14 more

ai-coding-assistant ai-tools antigravity autonomous-agents claude claude-code codex codex-cli coding-agent loop-engineering multi-agent openclaw self-hosted zero-human-company

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 11d

Audit‑log agent mutating actions now write to a tamper‑evident root:claude log, eliminating spoofing risks and fixing the Permission denied leak.

Why it matters: Severity 95 security fix for audit‑log agent CLI mutating actions; operators must upgrade to v0.9.13 immediately to prevent spoofing and permission‑denial exploits.

Summary

AI summary

Audit‑log agent mutating actions now write via a secure append‑only primitive, preventing spoofing and fixing a permission‑denial leak.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Audit-log agent-* mutating actions now write to tamper-evident root:claude log, prevent spoofing and fix Permission denied leak. Audit-log agent-* mutating actions now write to tamper-evident root:claude log, prevent spoofing and fix Permission denied leak. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Mutating actions re‑stamp `.user` from `SUDO_USER` to prevent actor spoofing. Mutating actions re‑stamp `.user` from `SUDO_USER` to prevent actor spoofing. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	High	Non‑object entries are dropped in the audit log. Non‑object entries are dropped in the audit log. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	High	The audit log is append‑only and never executes input. The audit log is append‑only and never executes input. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	High	Fixed a `Permission denied` stderr leak in the audit‑log handling. Fixed a `Permission denied` stderr leak in the audit‑log handling. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—

Full changelog

Security

Audit-log agent-* mutating actions (DIVE-1268). Non-root agent-* CLI callers (task done/answer, agent send) now land their mutating actions in the 640 root:claude tamper-evident audit log via a new hidden, append-only 5dive _audit_append NOPASSWD primitive — re-stamps .user from SUDO_USER (no actor spoofing), drops non-objects, append-only, never execs input. No perms loosened to a tamperable 660. Also fixes a Permission denied stderr leak. Diff-reviewed + on-box e2e verified (fresh standard-agent grant valid; re-stamp confirmed).

Security Fixes

CVE-2024-XXXXX — Prevented actor spoofing and fixed Permission denied stderr leak in non‑root agent-* CLI mutating actions (DIVE-1268)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track 5dive

Get notified when new releases ship.

About 5dive

All releases →

Related context

Related tools

Earlier breaking changes

v0.11.22 council amend now requires constitutional-class motion for constitution changes
v0.11.9 CLI now only OFFERS a veto to the genesis principal; EXERCISE requires authenticated tap.
v0.11.5 Raw bench add/rm of the primary council is refused.
v0.11.5 `council init` now requires sudo and seeds the primary council bench.
v0.10.7 Changes delegated-push grant to be BUILDER-SCOPED, limiting push permissions.