2 Commits

Author	SHA1	Message	Date
Diego Rodrigues de Sa e Souza	9cb91dee74	fix(security): close round-3 advisories (v7g9, x7vm, j7j4, jcm5) + exposure warning (wmgv) (#11261) ... Validated on a 2-PR combined board: routeGuard 36/36 (within the 68/68 focused-file total), a2a-task-owner-idor 7/7, a2a-tasks-auth, search-baseurl-ssrf-guard, cli-serve-hostname, spawn-capable-prefixes-client-safe all green, typecheck:core + dashboard-typecheck clean, gates within baseline. Five real High-severity advisories fixed with TDD (each failing-then-passing): settings export/import-json ALWAYS_PROTECTED completion, MITM route LOCAL_ONLY+SPAWN_CAPABLE gating, search baseUrl SSRF/IMDS guard, A2A REST task auth+ownership (previously none at all), and the loud boot exposure warning. GHSA-cjv9 confirmed already closed on this base (verified). Round 3 of the advisory sweep.	2026-08-23 20:32:42 -03:00
Yahoo	2098ba3848	fix(cli): ignore non-Windows HOSTNAME when binding server (#10557) ... * fix(cli): ignore non-Windows HOSTNAME when binding server * chore(changelog): assign PR number	2026-08-17 08:09:19 -03:00