Skip to content

multica

v0.4.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 11d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Affected surfaces

auth rbac

Summary

AI summary

Adds Intel macOS packages, Grok Build CLI runtime, agents scope column and skeleton UI, Human Attribution Phase 1, workspace create command, server version in Help popover, random color picker option, new‑tab issue links, custom typed issue properties; fixes daemon routing, attribution chips, opencode runs, comment sanitization, Codex session isolation, database migrations, desktop canvas margin, ACP authentication, help menu crash, scroll restoration, dashboard CTAs, redaction of secrets.

Changes in this release

Feature Low

Support Intel macOS Desktop packages

Support Intel macOS Desktop packages

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Keep machine CLI status visible

Keep machine CLI status visible

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Move daemon update to machine page

Move daemon update to machine page

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Make Inbox notification preference updates atomic

Make Inbox notification preference updates atomic

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Keep Inbox and sidebar unread counts static

Keep Inbox and sidebar unread counts static

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Add Grok Build CLI as an ACP runtime

Add Grok Build CLI as an ACP runtime

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Add access-scope column, filter, and bulk edit to agents list

Add access-scope column, filter, and bulk edit to agents list

Source: llm_adapter@2026-07-15

Confidence: high

 —
Performance Medium

Improve desktop and issues performance via single-router tab sessions and trace-driven surface overhaul

Improve desktop and issues performance via single-router tab sessions and trace-driven surface overhaul

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fix Lark recent context fetch degradation

Fix Lark recent context fetch degradation

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Negotiate websocket RPC support in daemon

Negotiate websocket RPC support in daemon

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

Changelog

  • 5b26b99722d312a0bade380acf4f2d1229de271f MUL-4164: support Intel macOS Desktop packages (#5436)
  • 54fd29ebddfd80c2d1531006aaf71b57d4a048d4 MUL-4383 fix(daemon): stop routing CodeBuddy skills/memory through Claude's .claude paths (#5224)
  • 51e4afc4800e978789bf30d57dc08457afa80df6 MUL-4753 Fix Lark recent context fetch degradation (#5401)
  • f2c4b2cf5097edd4d43dbe99c0e086c0ffd32364 MUL-4775: fix(daemon): negotiate websocket RPC support
  • bf64bb921493f9db900f5f2ed5c3352f941acea4 MUL-4781: keep machine CLI status visible
  • 2c482ab3666c9e3ab192bd4c3d4fc14b17c6ca86 MUL-4781: move daemon update to machine page (#5434)
  • 19e52e007c4e153ac5e6f62f58bb6da0711cfc53 MUL-4798: make Inbox notification preference updates atomic (#5451)
  • fff23c1fc3528883ca232a475ee2aa14541d3a1c MUL-4818: keep Inbox and sidebar unread counts static (#5461)
  • 1062c13bdc854fe1979b4cde3f406fb75b08f88d docs(changelog): add v0.4.2 release entry (2026-07-15) (#5453)
  • 06d79c17508a84070e1e71d689c9d4dd3ca4359b feat(agent): add Grok Build CLI as an ACP runtime (#5285)
  • b31132edf37e1af7701ed8959333e9b99c009cbe feat(agents): add access-scope column, filter, and bulk edit to agents list (#5393)
  • 56f453fed66e21d7e6c09f4e26d892b37ae5c4b7 feat(agents): add loading skeleton for Recent work list (#5438)
  • 4fac8d772ff558558e85749ec06b4170e811cf56 feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)
  • 7f12380f05c7f32c4e7f76554478b0d95e4c8b2a feat(cli): add workspace create command (#5062)
  • 7985699df9ee4c3c4a40858b49f434ca56faadf5 feat(help): surface the running server version in the Help popover (#4959)
  • 8f92b5fdeb042934953039b3fe3230036a3abcbc feat(search): add fold/unfold all comments commands to the command palette (#5417)
  • 07e2d378bd6d5e6cb3aacff50a322090c01ad952 feat(settings): add random color option to label and property color pickers (MUL-4786) (#5437)
  • 50e28d539c34b40355a18f271e6590a399d81955 feat(settings): open issue links in new tab by default, configurable in preferences (#5445)
  • b85bb71a582ee0a106290fcda8346599f2a383b9 feat: custom issue properties — typed workspace-defined fields with list-surface support (MUL-4463) (#5335)
  • 6455d390e25d40f69b0a00822db61365de1b9670 fix(agent): fail opencode runs whose stream ends without a terminal signal (#5238)
  • 0276704323cfdf860b2a39f02eb9965bd853aeb4 fix(attribution): hide unattributed chip when a task has no responsible member (MUL-4765) (#5418)
  • 45c0b38a94860b6cfe6f86905f587e61f2900a59 fix(attribution): put run avatar on the meta-line middot rhythm (MUL-4767) (#5420)
  • 9eddcaff100be15511149646e6c35465945e3dac fix(chat): defer cancellation-time finalization until the task transcript is stable (#5246)
  • 6caa3397ea2161d729e7fae24ac067fdabc1caf5 fix(comment): sanitize NUL/invalid bytes in comment content and trigger preview (#5391)
  • 6c9f58a2ca0f66ea14d01794e125f95bc98b2331 fix(daemon): accept valid task claim responses (#5432)
  • 6cc553e5a3799d32975a915122be38f8b4cbe461 fix(daemon): isolate Codex sessions per task to unblock initialize (MUL-4424) (#5360)
  • f46d5d7ba55fac0c42d77a6c9601a31c5de1524a fix(db): make issue property migrations deploy-safe (#5456)
  • 7468ce06be7d427c293e18131f109ab125b58e8a fix(desktop): match canvas left margin to right when sidebar is collapsed (#5430)
  • 66316c2614cd8a994a27f139468cfbb7eff2bb5c fix(grok): harden ACP authentication and capabilities (#5440)
  • 449d9887b5a210b02e5429ed683ec363d4d9e0d9 fix(help): wrap server-version row in DropdownMenuGroup to stop Help menu crash (#5458)
  • 9e4c73f8f4bb905e866527f747b12864716cbb6f fix(issues): stabilize scroll restoration (#5398)
  • dddcff87449786a0d883f4511e5e7f1df9fc6075 fix(landing): point dashboard CTAs at the real workspace route (#5442)
  • c599f47ba42b6d8baa3d6f97467aa10c0fa1b4a9 fix(redact): cover GitHub fine-grained PATs and Google API keys (#4678)
  • 101f21d55dd5be7e73f65645c212eb20aa7d26a3 fix(ui): render select labels instead of values (#5435)
  • 5999eabd9232e676e06716e721282a5048fb26a9 fix(views): stop showing backfilled attribution as a warning (MUL-4768) (#5421)
  • ea03912baf954f04dd61b867b7ee3ceaa4364e43 perf(desktop,issues): single-router tab sessions (MUL-4741 Phase 2) + trace-driven surface mount/render overhaul (MUL-4474/4750 reland) (#5403)
  • 09f69dfa05e3879e1e29dbcdb4c4a0963a49cd56 refactor(attribution): drop on-behalf badge from execution log rows (MUL-4766) (#5419)
  • 3cde13768bba6cf4fa9f35eade2e857105d77de5 test(desktop): de-flake UpdatesSettingsTab preference-load test (#5460)

Security Fixes

  • fix(grok): harden ACP authentication and capabilities
  • fix(redact): cover GitHub fine‑grained PATs and Google API keys
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track multica

Get notified when new releases ship.

Sign up free

About multica

The open-source managed agents platform. Turn coding agents into real teammates — assign tasks, track progress, compound skills.

All releases →

Related context

Earlier breaking changes

  • v0.3.8 Removes custom_env from agent resources, adds audited env endpoint (MUL-2600)

Beta — feedback welcome: [email protected]