This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
Summary
AI summaryUpdates Highlights, https://www.npmjs.com/package/@mulmobridge/twilio-sms/v/0.1.0, and https://github.com/receptron/mulmoclaude/tree/main/packages/bridges/twilio-sms across a mixed release.
Full changelog
First release of the Twilio SMS bridge for MulmoClaude. Every phone on Earth can text your AI agent.
Highlights
- Inbound webhook verified with HMAC-SHA1
X-Twilio-Signature(URL + sorted form params keyed on auth token) - Full URL including query string is used for signing, matching what Twilio posts
- Outbound via Twilio REST API (Basic auth)
- Number-based allowlist (
TWILIO_ALLOWED_NUMBERS) - Chunked at 1 600 chars (concatenated-SMS ceiling)
TWILIO_PUBLIC_URLrequired by default;TWILIO_ALLOW_UNVERIFIED=1opt-in for local dev
Public URL required — Twilio posts a webhook on each SMS.
📦 npm: @mulmobridge/[email protected]
📖 Setup: packages/bridges/twilio-sms/README.md
What's Changed
- feat(bridges): add Webhook + Twilio SMS + Email bridges (batch E) by @isamu in https://github.com/receptron/mulmoclaude/pull/619
Breaking Changes
- `TWILIO_PUBLIC_URL` is now required by default for inbound webhook reception
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MulmoClaude
All releases →Related context
Related tools
Earlier breaking changes
- v0.6.4 `General` role split into lean `General` and new `Personal` role; Encore seed role pinned to Personal.
Beta — feedback welcome: [email protected]