logly/mureo

v0.10.19 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 18d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

advertising agentic-ai ai-agents claude-code cli codex

+11 more

cursor facebook-ads gemini-cli google-ads marketing marketing-automation mcp meta-ads model-context-protocol python search-console

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 11d

This release fixes a cross‑client data isolation vulnerability in Search Console and corrects several package‑related mismatches and budget conversion bugs.

Why it matters: The security fix addresses a high‑severity (90) isolation flaw affecting search_console_sites_list handling; critical for developers, SREs, and security teams managing client data separation.

Summary

AI summary

Updates CUSTOM_PERIOD, fail-closed, and single-workspace across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes Search Console cross‑client data isolation vulnerability. Fixes Search Console cross‑client data isolation vulnerability. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature
Feature	Low	Adds Google Ads read‑only demographic & audience criteria plus image assets. Adds Google Ads read‑only demographic & audience criteria plus image assets. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Adds Google Ads budget type (daily vs total) get and set. Adds Google Ads budget type (daily vs total) get and set. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Adds Meta Ads ad‑set schedule and lifetime budget fields. Adds Meta Ads ad‑set schedule and lifetime budget fields. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Fixes About "Installed packages" mismatch with update checker. Fixes About "Installed packages" mismatch with update checker. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Fixes Meta Ads budget conversions for zero‑decimal currencies. Fixes Meta Ads budget conversions for zero‑decimal currencies. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

Added

Google Ads read-only demographic & audience criteria + image assets. New
google_ads_demographic_targeting_list (age range / gender / parental status
/ income range) and google_ads_audience_targeting_list (user interest, user
list, audience, custom affinity, custom audience, combined audience) surface
the criteria attached to ad groups, and google_ads_image_assets_list
returns image-asset name/type/size/dimensions. (#369)
Google Ads budget type (daily vs total) get and set. google_ads_budget_get
now reports the budget period (DAILY / CUSTOM_PERIOD) and
total_amount_micros; budget create/update accept a total (CUSTOM_PERIOD)
budget. (#371)
Meta Ads ad-set schedule & lifetime budget. meta_ads_ad_sets_update
gains end_time (pass 0 to clear the end date / run continuously) and
lifetime_budget (mutually exclusive with daily_budget). (#368)

Fixed

Search Console cross-client data isolation (security). In multi-account
(agency) deployments Search Console reused one operator-shared Google OAuth
and every tool took site_url as an unvalidated argument, so one client's
workspace could query a sibling client's property. site_url is now bound to
a per-client allow-list — out-of-scope values are refused (fail-closed) and
search_console_sites_list is filtered to the client's own properties; a
shared-OAuth backend that has not declared its allow-list fail-closes rather
than leaking. Standalone (single-workspace) installs are unchanged. (#375)
About "Installed packages" now agrees with the update checker. A
mureo.skills-only plugin (e.g. mureo-logly-tools) could be flagged
"update available" yet never appear under Installed; the About list now
unions the same name-prefixed mureo/mureo-* set the updater uses. (#365)
Meta Ads budget conversions honor zero-decimal currencies. Budget amounts
now respect each currency's offset, so JPY and other zero-decimal currencies
convert correctly. (#372)

Security Fixes

Search Console cross‑client data isolation enforced — `site_url` now validated against per‑client allow‑list, failing closed for out‑of‑scope values (#375)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track logly/mureo

Get notified when new releases ship.

About logly/mureo

Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.

All releases →