Skip to content

multica

v0.3.19 Feature

This release adds 5 notable features for engineering teams evaluating rollout.

Published 1mo AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 1mo

Harden all /uploads/* endpoints by enforcing authentication, disabling directory listings, adding X-Content-Type-Options: nosniff, and applying a strict Content‑Security‑Policy.

Why it matters: The security fact assigns severity 80 to the upload endpoint exposure; mitigating it directly reduces risk of unauthorized file access or data exfiltration.

Summary

AI summary

Updates to attachments, daemon config, issues UI, autopilot failures, CLI env handling, and transcript timestamps plus MUL‑2645 migration.

Changes in this release

Security High

Harden /uploads/* with auth, no listing, nosniff, tight CSP.

Harden /uploads/* with auth, no listing, nosniff, tight CSP.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Persist stable /api/attachments/<id>/download URL in comment markdown.

Persist stable /api/attachments/<id>/download URL in comment markdown.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Add timestamps to run transcript entries (MUL-3174).

Add timestamps to run transcript entries (MUL-3174).

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Show creator in autopilot detail properties (MUL-3139).

Show creator in autopilot detail properties (MUL-3139).

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Surface the real task initiator to the agent runtime (MUL-2645).

Surface the real task initiator to the agent runtime (MUL-2645).

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Gracefully shut down agent so OpenTelemetry telemetry flushes.

Gracefully shut down agent so OpenTelemetry telemetry flushes.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Enforce single resolution per comment thread.

Enforce single resolution per comment thread.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fail no‑progress issue runs in autopilot (MUL-3927).

Fail no‑progress issue runs in autopilot (MUL-3927).

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Drop FK on agent_task_queue.initiator_user_id (MUL-2645).

Drop FK on agent_task_queue.initiator_user_id (MUL-2645).

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fail autopilot create‑issue runs on any terminal task failure.

Fail autopilot create‑issue runs on any terminal task failure.

Source: llm_adapter@2026-06-10

Confidence: low

 —
Full changelog

Changelog

  • 906f70a3e20590558052b689e3b95a4f509364b9 Add comment trigger preview suppression (#3792)
  • a2ef95445b8dc8b62dae87a0e3ea7754a5e11917 MUL-2794 fix(agent): stop Cursor sessions on terminal result (#3165)
  • 13e9485a3b53c3bbf328ed58f372a6195e153a10 MUL-3130: persist stable /api/attachments//download URL in comment markdown (#3937)
  • 8ff68502fcdbdcae19e5d1460953e08b2903f52d MUL-3132: harden /uploads/* (auth, no listing, nosniff, tight CSP) (#3903)
  • d9347f0715823b179af0107be766be0c92dcb6c5 MUL-3175: add June 9 changelog entry (#3954)
  • 70ccbd9bce93d14359f2e2d1387b17b7301e9bef Revert "MUL-3132: harden /uploads/* (auth, no listing, nosniff, tight CSP) (#…" (#3944)
  • 9ff801f9266e28c66e2554c656c0882072e7acda docs(cli): error-message conventions + sign-in copy (PR3, MUL-3104) (#3900)
  • e15df22e98b50b39f5e52ee7ee5087379b3c4a0a feat(autopilots): show creator in autopilot detail properties (MUL-3139) (#3983)
  • 8b94764c471729494ad92ee183b94d092fd9c201 feat(daemon): configurable OpenClaw binary path / state dir via CLIConfig.Backends (MUL-3157)
  • 24b162cdbc9978cc6aad5de6f116114d8e365385 feat(daemon): surface the real task initiator to the agent runtime (MUL-2645) (#3899)
  • 0c80c33c627daa0748e8c6c98eba23bc44f83c88 feat(issues): add brand border beam to active agent header chip (#3921)
  • c983905d5c00988746062f82ec846e32acdb2c59 feat(issues): per-comment thread resolution with sticky collapse (#3910)
  • 26ca943d456d8aa1783ebb730477448c78ae446f feat(lark): add typing indicator lifecycle for inbound messages (#3860)
  • 9f21d0b634d5378c6513e1e079bb505bc9181359 feat(transcript): add timestamps to run transcript entries (MUL-3174) (#3951)
  • b1c8eb5f1173d78180f46790631a3a8b04542c6b feat: support Claude Fable 5 pricing (#3982)
  • 254ec945f5792e9aecfeb1768038c930fbebe4db fix(agent/codex): shut down gracefully so OTEL telemetry flushes (#3888)
  • 619c4c4953e5a5dba54ef2549398ba17f5d7d654 fix(attachments): bind description uploads via contentReferencesAttachment (#4001)
  • 2754b7d7d8dc411461e1e6b624532cf9e8abf5e4 fix(attachments): render description images with CDN URL (#4005)
  • abf99eb7000e1e345ddc00ec8ec7146b0f0cfa5c fix(attachments): server-driven markdown_url + legacy compat (MUL-3192) (#3991)
  • 998ebe97e40462c7de47ebf7f73ed7d82c119783 fix(autopilot): fail create-issue runs on any terminal task failure (#3943)
  • ee6200de25778baa19de4a114a801f02d5555f97 fix(autopilot): fail no-progress issue runs (#3927)
  • 42251b42fc122f05be29120629ee0e289b960909 fix(cli): honor MULTICA_SERVER_URL in setup self-host (#3912) (#3938)
  • 34c68e1e4c30373a843114f8b312449e4b6432c0 fix(comments): enforce single resolution per thread (#3984)
  • 2e0b0bb77646ea00def985dcaca92e7f664c7708 fix(db): drop FK on agent_task_queue.initiator_user_id (MUL-2645) (#3959)
  • ac75c977977dfa892afdb160cc09f725977a58aa fix(desktop): disable auto-start/stop toggles for a daemon the app can't control (WSL2) (#3940)
  • f2ba3c8f1a6554d76f08503d7181d4b68dd4a4f2 fix(editor): wrap tables in tableWrapper so wide tables scroll locally (#4003)
  • 2bdc8344dd45ac29916b7f74bc3d4b3d019ee264 fix(issues): align sticky comment header padding (#3952)
  • 90b639888d9ae348d937c3274dfe47f914b67824 fix(issues): confine inbox deep-link scroll to the timeline container (#3929) (#3942)
  • 072404d91295cc69ec51bbd161336a59ca75060e fix(issues): header chip shows 'is queued' when no agent is running (#3923)
  • a0b63462d054fc0e44876dc0377ef369fdcf5fd8 fix(issues): keep comment trigger preview fresh against live queue state (#4007)
  • b542c40936e9c31b1f44a92e42cd2fe068fdd15c fix(issues): keep sticky comment highlight consistent (#3955)
  • dc129b1178102913a43ab3f4141b9c2f98bb78e2 fix(issues): polish comment trigger chip presentation (#4002)
  • 6d646db57769f7bf099bc6308e981703051fa0d6 fix(issues): soften comment sticky mask (#3956)
  • d66730ecdbd03e8d72a488536a1d5114816a5d06 fix(issues): state-specific trigger chip copy (#4006)
  • 7dc05d28bc1dd4fdbc600392a36deb37241e8cd0 fix(projects): validate project status/priority — return 400 instead of 500 (#3925) (#3939)
  • 9455310c0cdfdede746ea98e96012e533af82b93 fix(realtime): invalidate per-issue caches on WS reconnect (#3992)
  • 72179d114595fd5634cdc67ccd1dc2d63ab89658 refactor(transcript): reuse payload helper + cover coalesce timestamps (MUL-3174) (#3958)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track multica

Get notified when new releases ship.

Sign up free

About multica

The open-source managed agents platform. Turn coding agents into real teammates — assign tasks, track progress, compound skills.

All releases →

Related context

Earlier breaking changes

  • v0.3.8 Removes custom_env from agent resources, adds audited env endpoint (MUL-2600)

Beta — feedback welcome: [email protected]