This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryVG953 now flags request bodies passed directly to Mongoose update calls.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Performance | Low |
Test coverage raised to approximately 97% with addition of 24 new offline test files. Test coverage raised to approximately 97% with addition of 24 new offline test files. Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Bugfix | Medium |
VG953 now flags request bodies passed directly to Mongoose update methods. VG953 now flags request bodies passed directly to Mongoose update methods. Source: llm_adapter@2026-06-07 Confidence: high |
— |
Full changelog
- VG953 now flags request bodies passed directly to Mongoose updates (findByIdAndUpdate(id, req.body), updateOne/findOneAndUpdate, etc.), not just the {...req.body} spread form; explicit-field updates are not flagged
- Test coverage raised to ~97% (24 new offline test files)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Related tools
Beta — feedback welcome: [email protected]