Regressionledger

v0.10.1 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

agent-memory ai-coding-agent anthropic claude-code claude-code-hook claude-code-hooks

+9 more

claude-code-marketplace claude-code-plugin claude-code-plugins claude-plugins cursor developer-tools nodejs regression vibe-coding

Affected surfaces

auth deps

Summary

AI summary

rl init will no longer clobber an existing settings.json; it validates first, backs up broken files, and aborts with a clear message.

Full changelog

## v0.10.1 — security review

An independent security pass (separate from the correctness gate). HIGH-1 (prompt-injection neutralization) was already mitigated in 0.10.0; the rest land here.

HIGH-2 — rl init can no longer clobber settings.json. An existing-but-unparseable file was previously swallowed and overwritten, destroying the user's hooks/permissions/env. init now parses first, backs the file up to settings.json.broken-<ts>.bak, and aborts with a clear message rather than writing.
MED-3 — ReDoS fixed. The Java/C# enclosing-symbol regex backtracked super-linearly on long whitespace (and ran on every edit). Rewritten bounded; 5000 spaces resolve in <1ms.
MED-4 — CI supply chain pinned. The demo workflow (contents: write) no longer installs ttyd/vhs at latest.
LOW-5 — recordHit is throw-proof. It runs right before a deny; a throw would fail-open and silently drop the block. Its I/O is now fully swallowed.

96 tests (5 new security tests) - zero dependencies.

Breaking Changes

`rl init` now validates and backs up `settings.json` instead of overwriting it; aborts with a clear message if the file is present but unparseable.

Security Fixes

HIGH-2 — Prevented `rl init` from clobbering an existing (but possibly broken) `settings.json`, protecting user hooks, permissions, and environment configurations.
MED-3 — Fixed a Regular Expression Denial‑of‑Service (ReDoS) caused by unbounded backtracking in the Java/C# enclosing‑symbol regex used on every edit.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Regressionledger

Get notified when new releases ship.

About Regressionledger

All releases →