This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+12 more
Affected surfaces
Summary
AI summaryFixed raw_sql_concat to correctly handle Ruby and Python constant interpolations, preventing witnessless SQL emission.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes raw_sql_concat false negatives for Ruby and Python. Fixes raw_sql_concat false negatives for Ruby and Python. Source: llm_adapter@2026-07-19 Confidence: low |
— |
| Bugfix | Medium |
Corrects raw_sql_concat to properly handle Ruby and Python interpolations. Corrects raw_sql_concat to properly handle Ruby and Python interpolations. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
Fixed
- The constant-only
raw_sql_concatexemption (v4.4.20) worked for TypeScript
ONLY; Ruby and Python were silently unprotected._interpolates_only_constants
extracted the interpolation slot withnext(g for g in groups if g is not None),
butre.findallon the multi-group alternation returns''(empty string), not
None, for groups that did not participate -- so it always picked group 1 (the
TS${...}slot) and read the Ruby#{...}/ Python{...}slot as empty. A
Rails/Django repositories cohort building safe SQL from a#{TABLE}/{COLUMNS}
module constant therefore still trippedraw_sql_concat, still lost its canonical
witness, and (via the paired v4.4.21 change) was emitted witnessless -- the exact
regression the exemption was written to prevent, in two of the three languages.
Fixed by testing the slot on truthiness (next((g for g in groups if g), "")),
which selects the group that actually matched and falls through safely on an
empty${}. Found by the step-7 clean-code review.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]