This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Summary
AI summaryGraduates to version 1.0.0, escaping the 0.x caret cascade.
Full changelog
Highlights
Graduates to 1.0.0 (escapes the 0.x caret cascade — ^1.0.0 floats across minors).
New CSV/env parsing helpers, consolidating ~17 hand-written bridge allowlist builders:
parseCsvList(raw, { lowercase? })— split a comma-separated env value into trimmed, non-empty entries.parseCsvSet(raw, { lowercase? })— same as aSet; an empty set is the canonical "allow all" sentinel (size === 0).
Since 0.1.0: also the shared type guards (isRecord, isObj, parseCsvSet, …). Consumed by the host, bridges, and relay (#2267/#2269/#2271/#2272).
Breaking Changes
- Minimum version bump to 1.0.0; `^1.0.0` no longer matches pre‑1.0 releases, breaking installations relying on the 0.x caret cascade.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MulmoClaude
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]