This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
Summary
AI summaryFixed a time‑of‑check to time‑of‑use race condition in claim_batch API pagination.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
resolve CodeQL / Semgrep / workflow code-scanning alerts resolve CodeQL / Semgrep / workflow code-scanning alerts Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low |
— |
| Feature | Medium |
unblocks post-CI dispatcher for auto-firing future patch releases unblocks post-CI dispatcher for auto-firing future patch releases Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high |
— |
| Bugfix | Medium |
repair Sonar workflow_run skip and verify GlitchTip CLI path repair Sonar workflow_run skip and verify GlitchTip CLI path Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high |
— |
| Bugfix | Medium |
scrub operator hostnames from docs and PR-comment surfaces scrub operator hostnames from docs and PR-comment surfaces Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high |
— |
| Bugfix | Medium |
replace blocking subprocess.run and narrow bare except clauses replace blocking subprocess.run and narrow bare except clauses Source: granite4.1:8b-q6_K@2026-05-20 Confidence: high |
— |
| Bugfix | Medium |
pagination cap, claim_batch TOCTOU fix, list_tasks single-pass filter pagination cap, claim_batch TOCTOU fix, list_tasks single-pass filter Source: granite4.1:8b-q6_K@2026-05-20 Confidence: low |
— |
Full changelog
Patch release catching up 5 fixes since v2.5.0:
- #1705 fix(security): resolve CodeQL / Semgrep / workflow code-scanning alerts
- #1713 fix(observability): repair Sonar workflow_run skip and verify GlitchTip CLI path
- #1718 fix(privacy): scrub operator hostnames from docs and PR-comment surfaces
- #1726 fix(routes): replace blocking subprocess.run + narrow bare except clauses
- #1727 fix(api): pagination cap + claim_batch TOCTOU + list_tasks single-pass filter
Plus #1730 unblocks the post-CI dispatcher so future patch releases auto-fire.
Security Fixes
- Fix #1727 – resolved TOCTOU race condition in `claim_batch` API pagination.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About chernistry/bernstein
Deterministic multi-agent orchestrator for 18 CLI coding agents (Claude Code, Codex, Cursor, Aider, Gemini CLI, OpenAI Agents SDK, and more). MCP server mode (stdio + HTTP/SSE) exposes the orchestrator to any MCP client. Git worktree isolation per agent, HMAC-chained audit trail, cost-aware model routing via contextual bandit. ~11K monthly PyPI downloads, Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]