This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+4 more
ReleasePort's take
Light signalThe worker dependency gate has been removed and the terminal command validation allowlist is now open, simplifying project workflows.
Why it matters: Removal of the dependency gate prevents setup loops; opening the allowlist enables broader terminal commands. These changes directly affect developer and SRE workflow efficiency in Aura v1.5.0.
Summary
AI summaryWorker dependency gate removed and terminal flow opened up for smoother project workflows.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Removed worker dependency gate preventing setup loops. Removed worker dependency gate preventing setup loops. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Opened up worker terminal command validation allowlist. Opened up worker terminal command validation allowlist. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Refactor | Low |
Craft now focuses solely on code‑quality checks, no longer handling dependency/setup logic. Craft now focuses solely on code‑quality checks, no longer handling dependency/setup logic. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Refactor | Low |
Project workflow streamlined to read → write → install if needed → validate → repair → done. Project workflow streamlined to read → write → install if needed → validate → repair → done. Source: llm_adapter@2026-06-05 Confidence: high |
— |
Full changelog
Highlights
Worker dependency gate removed
Aura no longer turns missing imports into a special dependency setup state that can freeze unrelated reads, writes, or terminal commands.
Workers can now handle project setup the normal way: install dependencies, run validation, and continue the task without getting trapped in a setup loop.
Worker terminal flow opened up
Worker terminal commands are no longer restricted by a narrow validation/install allowlist.
This fixes cases where normal commands like compileall, pytest, source inspection, project scripts, or CLI validation could be blocked or misclassified before the command even ran.
Python tool preflight also no longer blocks commands because Aura thinks pytest, ruff, or mypy is missing. The terminal output is now the source of truth.
Craft stays focused on code quality
Craft remains active as the code-quality gate:
- syntax problems
- placeholder/stub code
- fake implementations
- broad silent exception swallowing
- obvious AI slop
- contract violations
The key change is that Craft no longer participates in dependency/setup maze behavior. Craft guards code quality; validation proves the project.
Project workflow is smoother
Aura now behaves much closer to the intended loop:
read → write → install if needed → validate → repair → done
Aura’s goal is simple: take an LLM and make it produce human like, maintainable code inside real projects.
This release removes two major sources of harness friction that were getting in the Worker’s way. The result is a faster, cleaner, more natural coding workflow.
Breaking Changes
- Removed the special dependency setup state that froze unrelated reads, writes, or terminal commands when imports were missing.
- Eliminated the narrow validation/install allowlist for worker terminal commands, allowing unrestricted command execution.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Aura
All releases →Related context
Related tools
Earlier breaking changes
- v1.4.0 All file-writing paths now route through a validation pipeline.
Beta — feedback welcome: [email protected]