claude-flow

v3.10.38 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-ai agentic-framework agentic-workflow agents ai-agents ai-assistant

+14 more

ai-coding ai-skills autonomous-agents claude-code codex harness mcp-server multi-agent multi-agent-systems npm skills swarm swarm-intelligence typescript

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Fixed three high‑severity verification‑cluster bugs: missing dependency declaration, crash on ed25519 v2, and OOM during trajectory graph processing.

Changes in this release

Type	Severity	Summary	CVE
Dependency
Dependency	Low	Updates @claude-flow/security from 3.0.0-alpha.8 to 3.0.0-alpha.10, adding the missing noble dependency. Updates @claude-flow/security from 3.0.0-alpha.8 to 3.0.0-alpha.10, adding the missing noble dependency. Source: llm_adapter@2026-06-08 Confidence: high	—
Dependency	Low	Updates @claude-flow/cli from 3.10.37 to 3.10.38, pinning @claude-flow/security to ^3.0.0-alpha.10. Updates @claude-flow/cli from 3.10.37 to 3.10.38, pinning @claude-flow/security to ^3.0.0-alpha.10. Source: llm_adapter@2026-06-08 Confidence: high	—
Dependency	Low	Updates claude-flow from 3.10.37 to 3.10.38, aligning with @claude-flow/cli bump. Updates claude-flow from 3.10.37 to 3.10.38, aligning with @claude-flow/cli bump. Source: llm_adapter@2026-06-08 Confidence: high	—
Dependency	Low	Updates ruflo from 3.10.37 to 3.10.38, matching other package bumps. Updates ruflo from 3.10.37 to 3.10.38, matching other package bumps. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes missing @noble/ed25519 dependency in @claude-flow/security build, unblocking v3-ci.yml and pipeline jobs. Fixes missing @noble/ed25519 dependency in @claude-flow/security build, unblocking v3-ci.yml and pipeline jobs. Source: llm_adapter@2026-06-08 Confidence: low	—
Bugfix	Medium	Fixes crash in verify.mjs when @noble/ed25519 v2 lacks sha512Sync, ensuring signature verification works across platforms. Fixes crash in verify.mjs when @noble/ed25519 v2 lacks sha512Sync, ensuring signature verification works across platforms. Source: llm_adapter@2026-06-08 Confidence: low	—
Bugfix	Medium	Increases Node.js heap limit to 6 GB for smoke-trajectory-graph-edges.mjs CI job, preventing OOM exit 134. Increases Node.js heap limit to 6 GB for smoke-trajectory-graph-edges.mjs CI job, preventing OOM exit 134. Source: llm_adapter@2026-06-08 Confidence: low	—

Full changelog

Three HIGH-severity verification-cluster fixes from #2311, #2274, #2312, and #2275.

Fixed

#2311 — @claude-flow/security standalone TypeScript build (was breaking v3-ci.yml on main)
integrity-verifier.ts imported @noble/ed25519 but the dep was never declared on the package itself (root override didn't propagate — same lesson as #2112). Added directly to v3/@claude-flow/security/package.json. Unblocks the ToolOutputGuardrail smoke (ADR-131) job and the broader pipeline outage tracked in #2275.

#2274 — verify.mjs crashed on @noble/ed25519 v2 (witness integrity unverifiable)
verify.mjs:175 unconditionally assigned ed.etc.sha512Sync; on the v2 patch releases that freeze etc, this throws TypeError: Cannot add property sha512Sync, object is not extensible and skips every signature check. Wrapped in if (!ed.etc.sha512Sync) plus a try/catch — sha512Sync is already wired internally on v2, so the shim is only needed on v1. Validated against macOS, Linux, and Windows manifests on this checkout: Ed25519 signature valid: yes on all three, regressed=0 missing=0.

#2312 — smoke-trajectory-graph-edges.mjs OOM (ADR-130 P3 job, exit 134)
TEST 2's post-task chain (intelligence.recordTrajectory → @ruvector/ruvllm SonaCoordinator) blows past the default 4 GB heap. Bumped NODE_OPTIONS=--max-old-space-size=6144 on the CI step so the job completes; the underlying allocation profile in @ruvector/ruvllm is tracked as a follow-up.

Packages

| Package | Old | New | Tags |
|---|---|---|---|
| @claude-flow/security | 3.0.0-alpha.8 | 3.0.0-alpha.10 | latest, alpha, v3alpha |
| @claude-flow/cli | 3.10.37 | 3.10.38 | latest, alpha, v3alpha |
| claude-flow | 3.10.37 | 3.10.38 | latest, alpha, v3alpha |
| ruflo | 3.10.37 | 3.10.38 | latest, alpha, v3alpha |

@claude-flow/cli's @claude-flow/security dep now pins ^3.0.0-alpha.10 so the wrapper users pick up the noble dep automatically.

Not in this release

#2286 — npx @claude-flow/cli@alpha --version 60s timeout is install-bandwidth + postinstall, not CLI startup. The --version fast-path has been in place since 3.10.33 (commit 4c0144371) and exits before any heavy import. Verification harness measures cold npx -y which includes downloading the tarball + 300+ deps; nothing to fix in code.
#2319 — agentic-flow ./transport/loader export missing is an upstream issue (ruvnet/agentic-flow#153, plus a broken @fix dist-tag install). Cannot be fixed from this side until upstream lands the loader export in the stable ^2 release.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track claude-flow

Get notified when new releases ship.

About claude-flow

Deploy multi-agent swarms with coordinated workflows.

All releases →