This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
Summary
AI summaryUpdates Fixed — Connected services, Reliability & dead code, and Fixed — Assistant behavior across a mixed release.
Full changelog
Reliability release: wave 1 of a full-codebase audit — 14 confirmed, surgical, single-function fixes (each with a regression test written red-first) plus a hardening pass. No new user feature, no DB schema change, no migration.
Fixed — Connected services
- Apple Calendar events now honor the requested timezone (a "10:00 Europe/Paris" event no longer lands at 10:00 UTC; covers create + update).
- Microsoft Calendar search tolerates apostrophes (
l'anniversaireno longer breaks the OData filter → 400). - Google Tasks "list task lists" works again (a missing
()raisedAttributeErroron every call). - Route maps render correctly (a polyline-encoder operator-precedence bug corrupted multi-segment geometry).
Fixed — Assistant behavior
- Ambiguous Gmail labels now ask which one instead of a generic error (
KeyError). - Stopping a ReAct exploration (closing the conversation) actually cancels it (
CancelledErrorwas swallowed as a tool error). - Connector "not activated" messages are localized in all 6 languages (no more inline French in LLM-facing scaffolding).
Security & configuration
/users/search/by-emailis superuser-only (account-enumeration surface closed).- Planner budget/steps
.envoverrides are honored (one path always served a hardcoded 50$/50). - Two previously-hardcoded values become
.env-configurable: metrics sync interval, MCP ReAct step timeout.
Reliability & dead code
- Registry LRU eviction no longer crashes on mixed timestamp forms in long conversations.
QueryIntelligencefield silently dropped on every HITL resume restored (guarded by a full round-trip test).- LLM capability check unified (
tool_calling→tools); web client no longer leaks an abort timer per request. - Dead never-wired per-node message-windowing subsystem removed (ADR-094).
Test infrastructure
- The long-silently-rotted
tests/agentssuite (83 stale failures, never gated) is rehabilitated to green (1069 tests) and wired into CI. - A value-blind-test scanner (
scripts/analyze_value_blind_tests.py) closes the class of gap the polyline bug exposed — zero fully value-blind files remain.
Quality: Ruff / Black / MyPy strict clean; backend 8572 unit + 1069 agents green, frontend 120 green; i18n parity OK; Docker healthy. Full details in CHANGELOG.md.
Security Fixes
- /users/search/by-email endpoint now superuser‑only (closes account enumeration surface)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About LIA
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]