This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+11 more
Affected surfaces
Summary
AI summaryCurrency‑agnostic Meta Ads spend column added and BYOD Google Ads zero‑impressions regression fixed.
Full changelog
PyPI re-publish of v0.7.0 with the post-#54 fixes folded in. The original 0.7.0 was uploaded to PyPI by the GitHub Release workflow when PR #54 merged (2026-04-29 05:26 UTC) and predates these patches. PyPI's file-name reuse policy does not allow re-uploading the same version, so the consolidated fix set ships as 0.7.1.
What's new since 0.7.0
Added
- Currency-agnostic Meta Ads spend column — Meta exports the spend header as
Amount spent (XXX)whereXXXis the account's ISO currency code (JPY/USD/EUR/GBP/KRW/INR/ etc.). The previous JPY-only path rejected non-JPY accounts; the new_resolve_spend_idxstrips the suffix and_to_floatstrips a leading currency symbol from cell values. Cost values are stored raw in the account's own currency. (#58)
Fixed
- Meta Ads adapter alias corrections for
de_DE/es_ES/fr_FR— 7 mismatched header strings replaced with strings observed in real Ads Manager exports across 9 locales. (#56) - BYOD Google Ads zero-impressions/zero-clicks regression —
_to_intinmureo/byod/clients.pynow tolerates float-formatted strings like"98.0"(what the bundled Apps Script writes), so/daily-checkand/search-term-cleanupsee real impressions/clicks instead of zeros. (#60) - BYOD Meta
get_performance_reportnow surfacesresult_indicator— the per-campaign output dict gained aresult_indicatorfield so the agent can detect CV-definition mismatches (e.g. alink_click-optimized campaign masquerading as a high-CV-rate winner against a true lead-optimized sibling). (#61)
Changed
- All bundled command skills now name the specific MCP tools to call — fixes a reproducible BYOD failure mode where the agent looked for raw CSVs in the project directory and aborted because BYOD data lives under
~/.mureo/byod/. (#62) - Japanese BYOD walkthrough (
docs/byod.ja.md) added — native Japanese counterpart ofdocs/byod.md, restructured for Japanese readability rather than direct translation.README.ja.mddeep links repointed to the Japanese doc. (#57, #59)
Security
- Resolved 8 CodeQL Code Scanning alerts in OAuth + GAQL paths: response-splitting via
Locationheader, clear-text logging of OAuth URL / GAQL query content, and incomplete URL substring sanitization in tests. OAuth-URL validation now runs before any wizard session mutation. (#64)
Install
pip install --upgrade mureo
Full changelog: CHANGELOG.md → 0.7.1
Security Fixes
- Resolved CodeQL alerts: prevented response‑splitting via `Location` header, removed clear‑text logging of OAuth URL/GAQL query content, and fixed incomplete URL substring sanitization in tests (OAuth validation now runs pre‑mutation).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About logly/mureo
Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]