This release includes 1 security fix for security teams reviewing exposed deployments.
Published 19d
AI Agents & Assistants
✓ No known CVEs patched
This release patches 1 known CVE
Topics
ai
ai-assistant
apple
llm
claude
conversational-ai
+13 more
docker
emotional-ai
google
healthcare-ai
human-in-the-loop
langchain
langgraph
mcp
multi-agent
personal-assistant
self-hosted
skills
vision-ai
Summary
AI summaryUpdates https://lia.jeyswork.com/story, ADR-070, and ADR-069 across a mixed release.
Full changelog
Frontend/documentation release — no backend change, no DB migration.
Added — /story field report & landing proof
/storyfield-report page (6 languages): how LIA is built — nearly 100% of the code written by an AI under human direction (written rulebook, blocking automated checks, a review cycle where the human decides, adversarial audits), the structural trade-offs, operations, and the measured 8.0/10 across 20 areas audit profile, planned weaknesses included. Wired into the header nav (Présentation · Story · Philosophie · Technique · Blog · FAQ), both footers, a new landing RexSection and the FAQ ("How was LIA built?", 6 languages, mirrored indocs/knowledge/).- Animated hero chat demo: three rotating scenarios mirroring the real display modes with per-mode title-bar chips — HITL (humorous email draft, Send/Edit controls, approval), HTML cards (rich weather card + proactive cross-domain initiative), Markdown (multi-agent place search, numbered-list reply). Static under
prefers-reduced-motion. - Engineering proof band: 19+ agents · 76 tools · 7 providers · 99+ voice languages · 10,000+ tests · 100+ ADRs · 120+ releases · 8.0/10 audit — every figure sourced from the codebase (
LANDING_STATSdocuments each origin). - Today-briefing feature card — the home-page briefing was absent from every showcase surface.
Changed — landing redesign & fact corrections
- Two-mode diagram rebuilt to the real LangGraph topology (ADR-070): router fork, five numbered Pipeline steps with the human-approval step highlighted, ReAct reason→act→observe loop, "or" divider, streaming-response convergence.
- Landing: split hero (ambient gradients replace the background image; version + update date kept as a freshness signal), compacted rem-breakpoint feature grid, featured-card use-case grid, portrait-friendly screenshot frame,
FadeInOnScrollthreshold fix (tall sections revealed thousands of px late), SSR-rendered counters, rewritten "Under the hood" intro. - Facts corrected on every public surface (×6 locales + README + guides +
llms.txt): 7 LLM providers, not 8 ("Mistral" was an Ollama-served model in the pricing seed), 76 tools, 394 Prometheus metrics, 22 Grafana dashboards, 54 LLM config types, 14 personalities, 100+ ADRs, Gemini embeddings (ADR-069) instead of OpenAI, honest latency framing (first-SSE-event + LLM-cascade note). - French landing voice unified to tutoiement; de/es/it/zh use-case descriptions rewritten from telegraphic fragments to full sentences; guides version-harmonized (why 3.5 / how 2.6 across all six languages).
Fixed
- Anonymous visitors silently ejected from all public pages (production bug): the 401 handler's public-route list only covered login/register/root, so every logged-out visitor opening /why, /how, /blog or /faq bounced to /login after the session probe — invisible to developers, whose browsers always carry a session cookie. List extended to all public pages and locked by a filesystem-completeness test (31 new vitest tests): a new public page missing from the list now fails CI.
- Cloudflare Insights beacon blocked by CSP (console error on every prod page) — allowed and pinned as the single permitted external script host (ADR-098 policy+test discipline).
- SEO JsonLd repaired:
sameAspointed to a non-existent repository,softwareVersionwas hardcoded to 1.8.2, WebSite description said 15 agents;llms.txtfully rewritten. - Presentation subtitle said 13 slides; the carousel ships 15 (×6 locales).
Removed
- Dead landing components
HeroBackgroundandStatsSection(superseded by the live demo andProofSection);landing.stats.*/landing.hero.cta_secondarykeys pruned from all six locales.
Tests: 200 vitest green (169 + 31 new), tsc strict & ESLint clean, i18n parity across all 6 locales, every change verified on the rendered app (desktop, mobile, dark mode, anonymous session).
Security Fixes
- Fixed silent ejection of anonymous visitors from public pages preventing unauthorized access bypass
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About LIA
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]