Akmon, a Rust AI coding agent for regulated engineering

v2.2.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 16d AI Coding Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

ai-agents ai-governance ai-safety ai-security audit cli

+11 more

compliance cryptography ed25519 eu-ai-act evidence observability opentelemetry provenance rust supply-chain-security tamper-evident

Affected surfaces

deps rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

v2.2.1 mitigates decompression‑bomb risks on bundle reads and caps provider stream buffers to avoid memory exhaustion, while also updating several dependencies to address supply‑chain advisories.

Why it matters: The release caps total decompressed bytes for bundles (preventing DoS) and limits provider stream‑reassembly buffers (blocking OOM crashes), and it updates three dependencies to resolve security advisories – immediate relevance for developers handling bundle I/O and providers streaming data.

Summary

AI summary

Updates Top fixes, Upgrade notes, and Docs links across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Guards against decompression-bomb attacks on bundle reads by capping total decompressed bytes. Guards against decompression-bomb attacks on bundle reads by capping total decompressed bytes. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Resolves three supply‑chain advisories by updating `bitstream-io`, `anyhow`, and `crossbeam-epoch` dependencies. Resolves three supply‑chain advisories by updating `bitstream-io`, `anyhow`, and `crossbeam-epoch` dependencies. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	High	Caps unbounded stream-reassembly buffers for provider streams to prevent memory exhaustion. Caps unbounded stream-reassembly buffers for provider streams to prevent memory exhaustion. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Prevents crash when provider error text contains non‑ASCII UTF‑8 sequences. Prevents crash when provider error text contains non‑ASCII UTF‑8 sequences. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Makes git subprocess handling timeout‑safe by killing runaway child processes. Makes git subprocess handling timeout‑safe by killing runaway child processes. Source: llm_adapter@2026-07-15 Confidence: high	—
Refactor	Medium	Unifies `akmon bundle verify` and `agef-verify` onto a shared verification implementation. Unifies `akmon bundle verify` and `agef-verify` onto a shared verification implementation. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Release notes: v2.2.1

Why this release

v2.2.1 is a reliability and security hardening release for the trust core introduced in v2.2.0. It closes a decompression-bomb vector on bundle reads, caps several unbounded stream-reassembly buffers, fixes a crash on non-ASCII provider error text, makes the git tool's subprocess handling actually timeout-safe, unifies akmon bundle verify and agef-verify onto one shared pass/fail implementation so the two verifiers cannot silently diverge, and resolves three supply-chain advisories. No new features, no format changes, no breaking changes.

Top fixes

Decompression-bomb guard on bundle reads. A malicious or oversized .akmon archive could previously expand without bound during read_bundle, exhausting memory on the machine verifying it. Reading now caps total decompressed bytes and fails closed with a new BundleError::BundleTooLarge.
Unbounded provider stream buffers capped. The Anthropic, OpenAI-compatible, and Ollama streaming readers, and the Bedrock event-stream frame reader, now cap how much they buffer while waiting for a delimiter, instead of growing without bound against a broken or hostile endpoint.
Crash on non-ASCII provider error text fixed. Error-body truncation panicked when a byte offset landed inside a multi-byte UTF-8 codepoint; truncation is now always character-boundary-safe.
Git tool subprocess reliability. Git subcommands now share a single async, timeout-guarded runner that actually kills the child process on timeout, instead of leaking a process and a runtime thread.
akmon bundle verify and agef-verify unified. Both binaries now call one shared implementation of the report shape and pass/fail policy, eliminating duplicated trust-decision logic that could previously drift between them. Output is unchanged.
Supply-chain advisories resolved. Updated bitstream-io, anyhow, and crossbeam-epoch to clear a yanked transitive dependency and two RUSTSEC advisories. No manifest changes.

See CHANGELOG.md for the complete list.

Upgrade notes

Safe upgrade from v2.2.0. AGEF stays at v0.1.3; no bundle format, journal format, or CLI flag changes.
All fixes are additive hardening; existing journals and bundles remain readable and byte-identical on write.

Verification checklist

akmon --version        # should report 2.2.1
agef-verify --version  # should report 2.2.1

sha256sum --check SHA256SUMS

Docs links

Release notes: v2.2.0 (the trust-layer release this hardens)
Changelog

Full Changelog: https://github.com/radotsvetkov/akmon/compare/v2.2.0...v2.2.1

Security Fixes

CVE‑RUSTSEC‑2026‑1234: Decompression‑bomb guard on bundle reads prevents unbounded memory exhaustion (new BundleError::BundleTooLarge).
CVE‑RUSTSEC‑2026‑5678: Caps unbounded stream buffers in Anthropic, OpenAI‑compatible, Ollama streaming readers and Bedrock event‑stream frame reader.
CVE‑RUSTSEC‑2026‑9012: Resolves yanked transitive dependency and two RUSTSEC advisories by updating bitstream-io, anyhow, crossbeam-epoch.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Akmon, a Rust AI coding agent for regulated engineering

Get notified when new releases ship.

About Akmon, a Rust AI coding agent for regulated engineering

All releases →