This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+1 more
Summary
AI summaryFixed several undefined-name bugs causing silent fallbacks and added a pyflakes static test.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Added static pyflakes test over `src/` that fails on undefined‑name reports; pyflakes included in dev toolchain. Added static pyflakes test over `src/` that fails on undefined‑name reports; pyflakes included in dev toolchain. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
`status://mcp_version` now correctly reports update channel using `get_update_channel()`. `status://mcp_version` now correctly reports update channel using `get_update_channel()`. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
`versioning_auto_run_idle_timeout_seconds` preference is now honored; default timeout adjusted accordingly. `versioning_auto_run_idle_timeout_seconds` preference is now honored; default timeout adjusted accordingly. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Resolve-state snapshot tokens now use stable `short_hash` instead of falling back to timestamp. Resolve-state snapshot tokens now use stable `short_hash` instead of falling back to timestamp. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Timeline-kernel live probe's MCP‑stub fallback no longer crashes due to missing `types` import. Timeline-kernel live probe's MCP‑stub fallback no longer crashes due to missing `types` import. Source: llm_adapter@2026-06-09 Confidence: high |
— |
Full changelog
v2.37.2
Static-audit fixes: four undefined-name references that silently fell back to defaults instead of erroring — the same bug class as the v2.37.0 confirm-token fix — plus a regression guard so the class stays extinct.
Fixed
- The
status://mcp_versionresource reported update channel"stable"unconditionally (the guarded call referenced a function that never existed). It now calls the realget_update_channel(), so beta/dev installs report their channel correctly. - The
versioning_auto_run_idle_timeout_secondspreference was silently ignored — the destructive hook called a misspelled preference-reader name inside a try/except, so the auto-run idle timeout was always 90s. Fixed with regression tests covering both the preference and default paths. - Resolve-state snapshot tokens always fell back to a timestamp because
short_hashwas never imported into the server namespace; tokens are now content-stable as intended. - The timeline-kernel live probe's MCP-stub fallback crashed with a
NameError(missingtypesimport) exactly in the only case it exists for (mcp library absent).
Added
- A static test that runs pyflakes over
src/and fails on any undefined-name report (skips when pyflakes is not installed). pyflakes is now part of the local dev toolchain.
Validation
- Offline unit suite: 1,022 tests, 0 failures, 0 errors. Static checks clean.
- None of the fixed paths call DaVinci Resolve scripting APIs; no live Resolve behavior changed.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]