Skip to content

LIA

v1.21.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai ai-assistant apple llm claude conversational-ai
+13 more
docker emotional-ai google healthcare-ai human-in-the-loop langchain langgraph mcp multi-agent personal-assistant self-hosted skills vision-ai

Affected surfaces

auth

Summary

AI summary

Updates Fixed — Connected services, Reliability & dead code, and Fixed — Assistant behavior across a mixed release.

Full changelog

Reliability release: wave 1 of a full-codebase audit — 14 confirmed, surgical, single-function fixes (each with a regression test written red-first) plus a hardening pass. No new user feature, no DB schema change, no migration.

Fixed — Connected services

  • Apple Calendar events now honor the requested timezone (a "10:00 Europe/Paris" event no longer lands at 10:00 UTC; covers create + update).
  • Microsoft Calendar search tolerates apostrophes (l'anniversaire no longer breaks the OData filter → 400).
  • Google Tasks "list task lists" works again (a missing () raised AttributeError on every call).
  • Route maps render correctly (a polyline-encoder operator-precedence bug corrupted multi-segment geometry).

Fixed — Assistant behavior

  • Ambiguous Gmail labels now ask which one instead of a generic error (KeyError).
  • Stopping a ReAct exploration (closing the conversation) actually cancels it (CancelledError was swallowed as a tool error).
  • Connector "not activated" messages are localized in all 6 languages (no more inline French in LLM-facing scaffolding).

Security & configuration

  • /users/search/by-email is superuser-only (account-enumeration surface closed).
  • Planner budget/steps .env overrides are honored (one path always served a hardcoded 50$/50).
  • Two previously-hardcoded values become .env-configurable: metrics sync interval, MCP ReAct step timeout.

Reliability & dead code

  • Registry LRU eviction no longer crashes on mixed timestamp forms in long conversations.
  • QueryIntelligence field silently dropped on every HITL resume restored (guarded by a full round-trip test).
  • LLM capability check unified (tool_callingtools); web client no longer leaks an abort timer per request.
  • Dead never-wired per-node message-windowing subsystem removed (ADR-094).

Test infrastructure

  • The long-silently-rotted tests/agents suite (83 stale failures, never gated) is rehabilitated to green (1069 tests) and wired into CI.
  • A value-blind-test scanner (scripts/analyze_value_blind_tests.py) closes the class of gap the polyline bug exposed — zero fully value-blind files remain.

Quality: Ruff / Black / MyPy strict clean; backend 8572 unit + 1069 agents green, frontend 120 green; i18n parity OK; Docker healthy. Full details in CHANGELOG.md.

Security Fixes

  • /users/search/by-email endpoint now superuser‑only (closes account enumeration surface)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track LIA

Get notified when new releases ship.

Sign up free

Beta — feedback welcome: [email protected]