Skip to content

I4cTime/quantum_ring

v0.12.0 Security

This release includes 7 security fixes for security teams reviewing exposed deployments.

Published 1mo Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 7 known CVEs

Topics

ai-agents claude-code cursor keyring mcp mcp-server
+2 more
secrets-management security

Affected surfaces

auth

Summary

AI summary

Updates 🔒 Security hardening, ⚠️ Breaking, and 📊 Dashboard across a mixed release.

Full changelog

🔒 Security hardening

  • export_secrets honors the requiresApproval gate on bulk MCP reads
  • Governance policy anchored to the MCP server's launch directory (no projectPath escape)
  • import_dotenv over MCP no longer reads arbitrary files (content-only)
  • SSRF: connect-time re-validation closes the DNS-rebinding window
  • Teleport PBKDF2 100k → 210k (legacy bundles still decrypt)
  • Status dashboard endpoints require a per-launch token
  • Hardened exec network/command guards; policy cache invalidates on .q-ring.json change

📊 Dashboard

  • Rebuilt on Preact + htm with VDOM diffing — fixes the flicker/reload-on-update; still a single self-contained, offline page

📦 Dependencies & CI

  • Cleared 23 Dependabot alerts; pinned pnpm via packageManager; added Dependabot config + PR template

⚠️ Breaking

  • Dashboard returns 403 without its token (use the printed URL)
  • A single MCP server now applies only its launch directory's .q-ring.json policy

Full notes: CHANGELOG.md

Breaking Changes

  • Dashboard now returns `403` without a per‑launch token (use the printed URL).
  • MCP server applies only its launch directory's `.q-ring.json` policy.

Security Fixes

  • `export_secrets` now honors the `requiresApproval` gate on bulk MCP reads.
  • Governance policy anchored to MCP server's launch directory prevents `projectPath` escape.
  • `import_dotenv` over MCP restricted to content‑only, blocking arbitrary file reads.
  • Connect‑time re‑validation closes DNS‑rebinding window for SSRF.
  • Teleport PBKDF2 iteration count increased from 100k to 210k (legacy bundles still decrypt).
  • Status dashboard endpoints now require a per‑launch token.
  • Exec network/command guards hardened; policy cache invalidates on `.q-ring.json` change.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track I4cTime/quantum_ring

Get notified when new releases ship.

Sign up free

About I4cTime/quantum_ring

Quantum-inspired keyring for AI coding agents. Secure secrets with superposition, entanglement, tunneling, and teleportation.

All releases →

Related context

Earlier breaking changes

  • v0.13.0 Breaks scripts relying on unconfirmed destructive CLI operations; now requires `--yes` to bypass confirmation prompts.

Beta — feedback welcome: [email protected]