BlazeUp-AI/Observal](https:

v1.9.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

✓ No known CVEs patched

This release patches 1 known CVE

Topics

agents analytics antigravity claude-code cli-tool codex

+11 more

cursor cursor-ai insights kiro large-language-models mcp pi playground registry self-hosted skills

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates 1.9.0] - 2026-06-22, Testing, and Harden across a mixed release.

Full changelog

add self registration (auth) (c1d07a0)
show harness model overrides (web) (d38492d)
add harness model catalogs (models) (d07d5ca)
rename registry and adapters (harness) (8346c81)
soft delete agents (agent) (3f4b850)
expose agent model and target controls (web) (c3a4f54)
live end-to-end test + per-step diagnostics on real logins (sso) (088d123)
structured per-check diagnostics + tier-3 validators (sso) (f9e0db8)
add SSO health validators and fix SAML PEM parsing (sso) (bda76b5)

select pnpm binary by arch (docker) (9b3345b)
propagate MCP auth headers during agent pull (pull) (7de9cb0)
finish install terminology (harness) (1aa0c0f)
restore json agent profiles (kiro) (345b148)
simplify harness model overrides (web) (3d26ddd)
validate model filters and codex paths (harness) (c7fbb74)
generate cli agent files (antigravity) (fa9e72e)
include all configured ides (preview) (00c4fa5)
remove models.dev model dropdown (web) (459685c)
align config paths (antigravity) (8013eb6)
align custom agent paths (copilot-cli) (1f6aa1f)
use custom agent profiles (copilot) (cc1f8fc)
tighten agent builder layout (web) (eae6985)
restore per harness model overrides (web) (e07bfbf)
use server generated previews (web) (fb85927)
generate custom agent files (codex) (9684959)
preview harness agent paths (web) (c6eb2d8)
install agents as subagents (cursor) (589200d)
stream remote logs (cli) (7347ad2)
unbreak pnpm lockfile + bump Dockerfile.web pnpm version (ci) (fe58f15)
use urlencode() for sso_error redirect URLs (sso) (84c17ac)
patch CodeQL XSS/redirect/taint findings + drop design note (sso,ci) (80c575f)
address reviewer comments + corepack timeout (ci,docker,web) (0b65364)
patch CVEs, sanitize error responses, fix pnpm setup (security,ci) (5cb0022)
make clipboard copy reliable (web) (97ead63)
remove deprecated eval score names (telemetry) (b9228c3)

rate limit, wall-clock budget, shared client, frontend checks (sso) (084d8a6)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track BlazeUp-AI/Observal](https:

Get notified when new releases ship.

About BlazeUp-AI/Observal](https:

v1.6.0 rename logger alias to optic (audit)
v1.2.0 Removes legacy pre-JSONL modules in insights.
v1.2.0 Removes agent visibility and team access features.
v1.1.0 Replace deployment_mode API field with licensed boolean.
v0.8.0 Removes goal template, replaces with required prompt field in agent configuration.