Skip to content

LIA

v1.21.17 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai ai-assistant apple llm claude conversational-ai
+13 more
docker emotional-ai google healthcare-ai human-in-the-loop langchain langgraph mcp multi-agent personal-assistant self-hosted skills vision-ai

Summary

AI summary

Updates https://lia.jeyswork.com/story, ADR-070, and ADR-069 across a mixed release.

Full changelog

Frontend/documentation release — no backend change, no DB migration.

Added — /story field report & landing proof

  • /story field-report page (6 languages): how LIA is built — nearly 100% of the code written by an AI under human direction (written rulebook, blocking automated checks, a review cycle where the human decides, adversarial audits), the structural trade-offs, operations, and the measured 8.0/10 across 20 areas audit profile, planned weaknesses included. Wired into the header nav (Présentation · Story · Philosophie · Technique · Blog · FAQ), both footers, a new landing RexSection and the FAQ ("How was LIA built?", 6 languages, mirrored in docs/knowledge/).
  • Animated hero chat demo: three rotating scenarios mirroring the real display modes with per-mode title-bar chips — HITL (humorous email draft, Send/Edit controls, approval), HTML cards (rich weather card + proactive cross-domain initiative), Markdown (multi-agent place search, numbered-list reply). Static under prefers-reduced-motion.
  • Engineering proof band: 19+ agents · 76 tools · 7 providers · 99+ voice languages · 10,000+ tests · 100+ ADRs · 120+ releases · 8.0/10 audit — every figure sourced from the codebase (LANDING_STATS documents each origin).
  • Today-briefing feature card — the home-page briefing was absent from every showcase surface.

Changed — landing redesign & fact corrections

  • Two-mode diagram rebuilt to the real LangGraph topology (ADR-070): router fork, five numbered Pipeline steps with the human-approval step highlighted, ReAct reason→act→observe loop, "or" divider, streaming-response convergence.
  • Landing: split hero (ambient gradients replace the background image; version + update date kept as a freshness signal), compacted rem-breakpoint feature grid, featured-card use-case grid, portrait-friendly screenshot frame, FadeInOnScroll threshold fix (tall sections revealed thousands of px late), SSR-rendered counters, rewritten "Under the hood" intro.
  • Facts corrected on every public surface (×6 locales + README + guides + llms.txt): 7 LLM providers, not 8 ("Mistral" was an Ollama-served model in the pricing seed), 76 tools, 394 Prometheus metrics, 22 Grafana dashboards, 54 LLM config types, 14 personalities, 100+ ADRs, Gemini embeddings (ADR-069) instead of OpenAI, honest latency framing (first-SSE-event + LLM-cascade note).
  • French landing voice unified to tutoiement; de/es/it/zh use-case descriptions rewritten from telegraphic fragments to full sentences; guides version-harmonized (why 3.5 / how 2.6 across all six languages).

Fixed

  • Anonymous visitors silently ejected from all public pages (production bug): the 401 handler's public-route list only covered login/register/root, so every logged-out visitor opening /why, /how, /blog or /faq bounced to /login after the session probe — invisible to developers, whose browsers always carry a session cookie. List extended to all public pages and locked by a filesystem-completeness test (31 new vitest tests): a new public page missing from the list now fails CI.
  • Cloudflare Insights beacon blocked by CSP (console error on every prod page) — allowed and pinned as the single permitted external script host (ADR-098 policy+test discipline).
  • SEO JsonLd repaired: sameAs pointed to a non-existent repository, softwareVersion was hardcoded to 1.8.2, WebSite description said 15 agents; llms.txt fully rewritten.
  • Presentation subtitle said 13 slides; the carousel ships 15 (×6 locales).

Removed

  • Dead landing components HeroBackground and StatsSection (superseded by the live demo and ProofSection); landing.stats.* / landing.hero.cta_secondary keys pruned from all six locales.

Tests: 200 vitest green (169 + 31 new), tsc strict & ESLint clean, i18n parity across all 6 locales, every change verified on the rendered app (desktop, mobile, dark mode, anonymous session).

Security Fixes

  • Fixed silent ejection of anonymous visitors from public pages preventing unauthorized access bypass

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track LIA

Get notified when new releases ship.

Sign up free

Beta — feedback welcome: [email protected]