spec-kit

v0.12.12 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 13d Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ai copilot development engineering prd spec

+1 more

spec-driven

ReleasePort's take

Light signal

editorial:auto 12d

Release v0.12.12 fixes several bugs affecting extensions, presets, workflows, and bundle handling while deprecating markdown in copilot skills mode.

Why it matters: Patches corrupted boolean priority (id 62930), caps max_iterations ignoring bools (id 62931), hardens catalog.py against malformed data (id 62932), enforces HTTPS‑only catalog URLs (id 62933), resolves env‑var prefix collisions (id 62934), and deprecates markdown in copilot --skills flag (id 62936).

Summary

AI summary

Updates chore, extensions, and workflows across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Adds Verify Review Ship extension to community catalog. Adds Verify Review Ship extension to community catalog. Source: llm_adapter@2026-07-14 Confidence: high	—
Deprecation	Low	Deprecates markdown usage in copilot skills mode. Deprecates markdown usage in copilot skills mode. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix
Bugfix	Medium	Repairs corrupted boolean priority in extensions and presets. Repairs corrupted boolean priority in extensions and presets. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Ignores bool values for max_iterations in engine loop cap. Ignores bool values for max_iterations in engine loop cap. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Hardens catalog.py against mis‑shaped registry and non‑string fields. Hardens catalog.py against mis‑shaped registry and non‑string fields. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Rejects file:// or local download_url; catalog URLs must be HTTPS‑only. Rejects file:// or local download_url; catalog URLs must be HTTPS‑only. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Handles prefix‑colliding environment variables in _get_env_config. Handles prefix‑colliding environment variables in _get_env_config. Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Install

uv tool install specify-cli --from git+https://github.com/github/[email protected]
specify init my-project

What's Changed

chore: bump version to 0.12.12
fix(extensions): set-priority repairs corrupted boolean priority (#3268)
fix(presets): set-priority repairs corrupted boolean priority (#3269)
fix(workflows): engine loop cap ignores bool max_iterations (#3270)
docs(bundles): document --integration on 'bundle update' (#3271)
fix(workflows): harden catalog.py against mis-shaped registry & non-string fields (#3375)
Add Verify Review Ship extension to community catalog (#3450)
fix(bundle): reject file:// / local download_url — catalog URLs are HTTPS-only (#3344)
fix(extensions): handle prefix-colliding env vars in _get_env_config (#3350)
docs: document copilot skills mode (--skills) and markdown deprecation (#3313)
chore: release 0.12.11, begin 0.12.12.dev0 development (#3460)

Security Fixes

fix(bundle): reject file:// / local download_url — catalog URLs are HTTPS-only (#3344)
fix(workflows): harden catalog.py against mis‑shaped registry & non‑string fields (#3375)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track spec-kit

Get notified when new releases ship.

About spec-kit

All releases →

Related context

Related tools

Earlier breaking changes

v0.10.0 Legacy AI flags (--ai, --ai-commands-dir, --ai-skills) removed.
v0.10.0 Git extension is now opt-in; --no-git flag removed.