This release includes 5 security fixes for security teams reviewing exposed deployments.
Published 3d
MCP Data & Storage
✓ No known CVEs patched
This release patches 5 known CVEs
Topics
database
go
mysql
mysql-client
planetscale
Affected surfaces
auth
rce_ssrf
Summary
AI summaryFixes multiple OAuth token and credential leaks, Windows command injection, and SQL gate bypass vulnerabilities.
Full changelog
Changelog
- 76d92dbb4553f33ba6fd4491ef66040b23a03897 Fix OAuth token leak on sibling-subdomain redirects
- ba3dd4ae4bf513d89717c6cbcd04e571784b3a20 Fix Windows command injection when opening auth login URL
- 9a456a8f15f80e5eb0706e4f96cdae0f2d562eef Fix auth token leak on cross-host API client redirects
- d0168ff69ec5ea72eddd4990f74ce912a6a2033f Fix credential header leak on cross-domain API redirects
- 7ed8c54e0ed0c7ad6b1a99ea7083bc291adb2d53 Fix destructive SQL gate bypass via MySQL executable comments
- 082894c27917035ca451cb0018b0104edf1c427f Merge main and keep header-stripping on cross-host redirects
- b770362af467cc4eba921a6dbb8ff6d7cbedeaa7 Omit OAuth client credentials from auth help text
- 6f7cdf3ec0d4c8ffb7969422b6b1e2528ed11cba Remove unused OAuth client flags from auth check
- 0d3d18ebbfa300778bd200da557b5165f0d7e116 Sanitize connection observability fields before terminal output
- 4daaeb412fa8061bc2d046a02c06608403a88048 config: allowlist project .pscale.yml keys to block credential exfil
- 8762d166ab37cd090140d19cfa72159c206fbc35 d1 import: keep literal comment gofmt-stable
- 67d681a2acceac9f0cdb46f40c0ffa003c27cb90 d1 import: omit invalid table foreign keys
- e1bc8c9b21949144b02b3cd2f2ed728ba3c4e6c5 d1 import: run injection assertions before optional Postgres skip
- 98507d4466481e9a833deaa1c62284305308aa9f d1 import: stop emitting untrusted DEFAULT/REFERENCES SQL verbatim
- 6bf3a549e4b229da4f18e4aa1d6cbfeb0d716859 d1 import: stop parseTableBody at balanced CREATE TABLE close
Security Fixes
- Fix OAuth token leak on sibling-subdomain redirects
- Fix Windows command injection when opening auth login URL
- Fix auth token leak on cross-host API client redirects
- Fix credential header leak on cross-domain API redirects
- Fix destructive SQL gate bypass via MySQL executable comments
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v0.287.0 Requires --keep-data and --keep-routing-rules flags for move-tables complete and cancel operations
Beta — feedback welcome: [email protected]