costajohnt/oss-autopilot

vcore-v3.13.1 scope: core Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai-agent anthropic claude-code claude-code-plugin cli contribution-tracker

+6 more

developer-tools github github-automation issue-discovery pr-management typescript

Affected surfaces

auth

ReleasePort's take

Light signal

editorial:auto 1mo

The release fixes dashboard mutation retries, partition status alignment with the CLI, and pins contract goldens to their schemas. It also fences lastMaintainerComment.body at agent‑facing API boundaries to prevent injection.

Why it matters: Addresses three bugfixes (dashboard mutations, partitioning, contract goldens) and a high‑severity security fix (severity 90) that blocks injection via agent‑facing APIs; critical for developers, SREs, and security engineers monitoring those surfaces.

Summary

AI summary

Updates Bug Fixes, 3.13.1, and 2026-06-12 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fences lastMaintainerComment.body at agent‑facing boundaries to prevent injection. Fences lastMaintainerComment.body at agent‑facing boundaries to prevent injection. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes dashboard mutations to surface and retry failed Gist checkpoints. Fixes dashboard mutations to surface and retry failed Gist checkpoints. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Fixes dashboard partitioning to match post-override status with CLI. Fixes dashboard partitioning to match post-override status with CLI. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Pins contract goldens to their output schemas and typechecks tests. Pins contract goldens to their output schemas and typechecks tests. Source: llm_adapter@2026-06-12 Confidence: high	—

Full changelog

3.13.1 (2026-06-12)

Bug Fixes

core: dashboard mutations surface and retry failed Gist checkpoints (#1426) (4b7dc3f), closes #1417
core: dashboard partitions on post-override status, matching the CLI (#1424) (e720ec4), closes #1416
core: pin contract goldens to their output schemas and typecheck tests (#1422) (d6ac828), closes #1418
security: fence lastMaintainerComment.body at agent-facing boundaries (#1427) (6707ecf), closes #1420

Security Fixes

Security: fence lastMaintainerComment.body at agent-facing boundaries (closes #1420)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track costajohnt/oss-autopilot

Get notified when new releases ship.

About costajohnt/oss-autopilot

Open source contribution manager with PR tracking across repos, issue discovery, CI failure diagnosis, and maintainer response drafting. Available as CLI, MCP server, and Claude Code plugin.

All releases →