This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
Summary
AI summaryUpdates Patch Changes, Minor Changes, and c10427a across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds n8n agentic-callback ruleset for detecting unverified webhook sinks. Adds n8n agentic-callback ruleset for detecting unverified webhook sinks. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Low |
Adds Anthropic Agent SDK tool-callback ruleset. Adds Anthropic Agent SDK tool-callback ruleset. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Low |
Adds `compliance_mappings` schema covering SOC 2, ISO 27001, EU AI Act Annex III, and NIST AI RMF. Adds `compliance_mappings` schema covering SOC 2, ISO 27001, EU AI Act Annex III, and NIST AI RMF. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Low |
Includes v1.1 evidence pack with EU AI Act Annex III high‑risk classification and offline‑verifiable signing key. Includes v1.1 evidence pack with EU AI Act Annex III high‑risk classification and offline‑verifiable signing key. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Dependency | Low |
Updates dependencies to @hookwarden/[email protected]. Updates dependencies to @hookwarden/[email protected]. Source: llm_adapter@2026-06-03 Confidence: high |
— |
Full changelog
Minor Changes
-
c10427a: v0.8 launch — webhook integrity, from first line to final audit.
This is the stable v0.8 cut of the CLI + engine + rules cluster. It rolls up the
v0.8 milestone surface: the n8n agentic-callback ruleset (detecting unverified
agent/tool webhook sinks, shipped after the Cisco Talos n8n abuse report), the
Anthropic Agent SDK tool-callback ruleset, and thecompliance_mappingsschema
(SOC 2 + ISO 27001 + EU AI Act Annex III + NIST AI RMF) surfaced in
hookwarden --version --verbose, with the v1.1 evidence pack carrying the EU AI
Act Annex III high-risk classification and an embedded offline-verifiable
signing key.The MCP server shipped earlier in the v0.8 cycle and versions independently of
this fixed cluster, so it is intentionally not part of this changeset.
Patch Changes
- Updated dependencies [8f8c131]
- Updated dependencies [46c2a97]
- Updated dependencies [ade4609]
- Updated dependencies [056ba21]
- Updated dependencies [c7f1046]
- Updated dependencies [729c7a1]
- Updated dependencies [1bd1791]
- Updated dependencies [c10427a]
- @hookwarden/[email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Hookwarden
All releases →Related context
Beta — feedback welcome: [email protected]