Diego Rodrigues de Sa e Souza 9cb91dee74 fix(security): close round-3 advisories (v7g9, x7vm, j7j4, jcm5) + exposure warning (wmgv) (#11261) ...

Validated on a 2-PR combined board: routeGuard 36/36 (within the 68/68 focused-file total), a2a-task-owner-idor 7/7, a2a-tasks-auth, search-baseurl-ssrf-guard, cli-serve-hostname, spawn-capable-prefixes-client-safe all green, typecheck:core + dashboard-typecheck clean, gates within baseline. Five real High-severity advisories fixed with TDD (each failing-then-passing): settings export/import-json ALWAYS_PROTECTED completion, MITM route LOCAL_ONLY+SPAWN_CAPABLE gating, search baseUrl SSRF/IMDS guard, A2A REST task auth+ownership (previously none at all), and the loud boot exposure warning. GHSA-cjv9 confirmed already closed on this base (verified). Round 3 of the advisory sweep.

2026-08-23 20:32:42 -03:00

..

classify.test.ts

fix: Stabilize live dashboard WebSocket routing (#6335)

2026-07-09 23:19:32 -03:00

client-api-policy-fallback.test.ts

…

client-api-policy.test.ts

feat(api): accept x-goog-api-key header for client-facing auth (#7034) (#7236)

2026-07-17 10:48:14 -03:00

csrf.test.ts

…

discovery-routes-local-only.test.ts

…

ip-filter-enforcement-6131.test.ts

…

management-policy.test.ts

fix(mcp): preserve caller identity for internal REST hops (#9260)

2026-08-05 21:45:27 -03:00

oauth-autoimport-local-only.test.ts

fix(security): close remaining v3.8.50 advisories (batch 2 — 11 findings) (#11040)

2026-08-21 20:28:16 -03:00

pipeline.test.ts

fix(resilience): drain heavyweight SSE on SIGTERM (#11020)

2026-08-22 22:51:02 -03:00

probe-9033-repro.test.ts

fix(db): add transient-error retry to corruption probe to prevent data loss under concurrent load (#9541)

2026-08-06 22:55:10 -03:00

proxy-contract.test.ts

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00

proxy-matcher-case.test.ts

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00

public-origin.test.ts

…

public-policy.test.ts

…

route-guard-local-prefix.test.ts

…

route-guard-skills-collect.test.ts

…

route-guard-version-get-exemption.test.ts

…

route-guard-vnc-session-local-only.test.ts

feat(vnc-session): persistent noVNC browser login for web-cookie providers (#7892)

2026-07-22 10:46:04 -03:00

routeGuard.test.ts

fix(security): close round-3 advisories (v7g9, x7vm, j7j4, jcm5) + exposure warning (wmgv) (#11261)

2026-08-23 20:32:42 -03:00

spawn-capable-prefixes-client-safe.test.ts

fix(security): close round-3 advisories (v7g9, x7vm, j7j4, jcm5) + exposure warning (wmgv) (#11261)

2026-08-23 20:32:42 -03:00