Skip to content

claude-flow

v3.12.2 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-ai agentic-framework agentic-workflow agents ai-agents ai-assistant
+14 more
ai-coding ai-skills autonomous-agents claude-code codex harness mcp-server multi-agent multi-agent-systems npm skills swarm swarm-intelligence typescript

Affected surfaces

deps

Summary

AI summary

Updates or npm i ruflo@latest, Bundled fixes, and Dependabot bumps across a mixed release.

Full changelog

Bundled fixes

#2407 — daemon proliferation → kernel panic (CRITICAL)

Atomic O_EXCL lockfile in daemon.ts + dropped the shell & in init.ts:424. Race test verified: 5 concurrent daemon start → 1 surviving daemon (was 3-5+).

One real incident accumulated 39 zombie daemons holding ~8.5 GiB and contributed to a macOS kernel panic on June 15. No longer possible.

#2403 — security cve no longer a stub

Now delegates to npm audit --json (same GitHub Advisory DB source as security scan), extracts CVE IDs from via titles/URLs, supports --check CVE-XXXX-NNNN and --severity {critical,high,medium,low} filters. Local verify on this repo: 37 affected packages surfaced.

#2397 — .claude/helpers/* hooks hardening

Community contribution from @tjaiyen — 5 grounded bug fixes including real timeout via Promise.race (not the spurious "timer cleared on sync return" pattern), signal cleanup, truncation transparency, cross-platform slug normalization. 248+/49− across 8 files.

Dependabot bumps (3/5 merged cleanly)

  • @types/node 20.19.41 → 20.19.43 in /v3/@claude-flow/browser
  • vitest 4.1.6 → 4.1.9 in /v3/@claude-flow/browser + /plugins/ruflo-graph-intelligence
  • agent-browser 0.27.0 → 0.27.3 in /v3/@claude-flow/browser

(#2384 + #2386 had merge conflicts; dependabot will rebase.)

Install

npx [email protected]
# or
npm i ruflo@latest

Compatibility

All 3 packages × 3 dist-tags published in lockstep:

No API breaking changes. Patch bump per CLAUDE.md publishing policy.

🤖 Generated with RuFlo

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track claude-flow

Get notified when new releases ship.

Sign up free

About claude-flow

Deploy multi-agent swarms with coordinated workflows.

All releases →

Related context

Beta — feedback welcome: [email protected]