This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
ReleasePort's take
Light signalv2.17.1 fixes media_pool.append_to_timeline to retain the project handle during positioned appends and adds security documentation.
Why it matters: Patch to v2.17.1 immediately to prevent data consistency issues in media_pool operations; review the new SECURITY.md for local stdio trust boundary guidelines.
Summary
AI summaryFixed media_pool.append_to_timeline to retain project handle during positioned appends.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Granular tools explicitly annotated per public MCPSafe report findings. Granular tools explicitly annotated per public MCPSafe report findings. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Compound and granular tools publish MCP ToolAnnotations for metadata safety hints. Compound and granular tools publish MCP ToolAnnotations for metadata safety hints. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added SECURITY.md documenting local stdio trust boundary and vulnerability reporting. Added SECURITY.md documenting local stdio trust boundary and vulnerability reporting. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
README updated with security policy link and local-only auth posture. README updated with security policy link and local-only auth posture. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Resolve app-control subprocess fallbacks use bounded timeouts and report non-zero exits. Resolve app-control subprocess fallbacks use bounded timeouts and report non-zero exits. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Resolve object inspection swallowed exceptions now logged at debug level. Resolve object inspection swallowed exceptions now logged at debug level. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Fixed media_pool.append_to_timeline to retain project handle during positioned appends. Fixed media_pool.append_to_timeline to retain project handle during positioned appends. Source: llm_adapter@2026-05-21 Confidence: high |
— |
Full changelog
Operational and client-safety hardening for the v2.17 media-analysis release.
MCP tool metadata: compound and granular tools now publish MCP ToolAnnotations with conservative read-only, destructive, idempotent, and external-resource hints. Compound tool annotations are intentionally conservative because each tool groups multiple actions behind an action parameter.
MCPSafe report cleanup: explicitly annotated the granular tools highlighted by the public MCPSafe report, including project settings, media import, page switching, proxy linking, Gallery album reads, and timeline-item transforms.
Operational guardrails: Resolve app-control subprocess fallbacks now use bounded timeouts and report non-zero exits. Best-effort Resolve object inspection and state probes now log swallowed exceptions at debug level instead of failing silently.
Correctness fix: fixed the granular media_pool.append_to_timeline(clip_infos=...) path so it retains the current project handle while normalizing positioned appends against the active timeline start frame.
Documentation: added SECURITY.md with the local stdio trust boundary, confirmation guidance for destructive tools, source-media safety boundaries, and private vulnerability reporting guidance. The README now links the security policy and summarizes the local-only auth posture.
Validation: static/import checks, API parity audit, compileall, and 161 focused unit tests passed. Live validated against DaVinci Resolve Studio 20.3.2.9 with a direct external-scripting smoke test, tests/live_v233_validation.py passing 10/10 checks, and a v2.17.1 disposable-project media_pool.append_to_timeline(clip_infos=...) normalization probe passing 2/2 checks. The v2.17.1 probe used synthetic media only and verified the default relative record_frame path landed at timeline start frame 86400 + 12 = 86412, while record_frame_mode="absolute" preserved frame 86484.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]