This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Light signalThe Google OAuth token store location has changed to ~/.config/mulmo/google-token.json with automatic migration.
Why it matters: All deployments of MulmoClaude must update configuration paths; failure will cause authentication failures. Automatic migration handles existing tokens seamlessly.
Summary
AI summaryGoogle OAuth token store moves to ~/.config/mulmo/ with automatic migration.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Moves Google token store to ~/.config/mulmo/google-token.json Moves Google token store to ~/.config/mulmo/google-token.json Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Dependency | Low |
Updates @mulmoclaude/core to 0.20.1 and @mulmoclaude/google-plugin to 0.1.1 Updates @mulmoclaude/core to 0.20.1 and @mulmoclaude/google-plugin to 0.1.1 Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
Provides fallback read for legacy Google token file if migration fails Provides fallback read for legacy Google token file if migration fails Source: granite4.1:30b@2026-07-17-audit Confidence: low |
— |
| Refactor | Low |
Adds automatic migration of legacy Google token file on first read Adds automatic migration of legacy Google token file on first read Source: granite4.1:30b@2026-07-17-audit Confidence: low |
— |
Full changelog
Highlights
Google token store moves to ~/.config/mulmo/ (#2122, #2124)
The Google OAuth engine is shared with MulmoTerminal, so the token directory drops the app branding: ~/.config/mulmoclaude/google-token.json → ~/.config/mulmo/google-token.json.
- Automatic migration on first read — an atomic non-clobbering copy (
COPYFILE_EXCL, mode 600 preserved, TOCTOU-safe); the legacy file is removed only after a successful copy. - Legacy fallback read — a failed migration (permissions, read-only fs) never makes a linked account look unlinked.
Ships @mulmoclaude/[email protected] and @mulmoclaude/[email protected].
📦 npm: [email protected]
Full Changelog
See CHANGELOG.md for the complete list.
Breaking Changes
- Google OAuth token file path changed from `~/.config/mulmoclaude/google-token.json` to `~/.config/mulmo/google-token.json`. Legacy location is removed after successful migration.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MulmoClaude
All releases →Related context
Related tools
Earlier breaking changes
- v0.6.4 `General` role split into lean `General` and new `Personal` role; Encore seed role pinned to Personal.
Beta — feedback welcome: [email protected]