Repository navigation

Release v0.10.0 - #865

Merged

chronoai-shining merged 26 commits into

mainfrom

develop

Jun 5, 2026

Commits on May 29, 2026

Merge pull request #765 from ChronoAIProject/sync/post-release-v0.9.1
chronoai-shining
authored
c4f87c0

Commits on Jun 4, 2026

ci: extend PR CI to develop-auto + auto-base-guard backstop (#768)
chronoai-shining
authored
4cb7118
[Bug] Enforce private-skill visibility on playground skill-load (BOLA)
chronoai-shining
authored
b10cd71
[Bug] Reject path-traversal skill names on the skip_validation import path
chronoai-shining
authored
24adcea
[Bug] Atomically reserve quota to prevent concurrent over-cap (TOCTOU)
chronoai-shining
authored
2111788
[Bug] Add a per-user rate limit to POST /playground/chat
chronoai-shining
authored
4ecbb0c
[Bug] Bound pagination page to stop unbounded MongoDB skip()
chronoai-shining
authored
7056a91
[Bug] Re-resolve outbound hosts at fetch time for SSRF (DNS-rebind) parity
chronoai-shining
authored
94bdd35
[Bug] Skip idempotency capture for SSE/streaming responses
chronoai-shining
authored
75916db
[Bug] Key anonymous rate limits on a trusted client IP, not raw XFF
chronoai-shining
authored
2f71b81
[Misc] Back the rate limiter with a shared store (per-pod/restart-reset today)
chronoai-shining
authored
a893541
[Bug] Enforce caller org membership when sharing a skill into an org
chronoai-shining
authored
5f3ce51
[Feature] Full-bleed autoplay video background as the landing hero
chronoai-shining
authored
866d809
[Misc] Redact token/clientSecret/privateKey/accessToken in Pino logs
chronoai-shining
authored
d5dc629
[Bug] Reject traversal/dot segments in GitHub owner/repo identifiers (mirror + pull)
chronoai-shining
authored
da8d209
[Bug] Clamp playground sandbox timeout_secs to the advertised 1-600 range
chronoai-shining
authored
dfe3bd9
[Misc] Remove the unused requireOwnerOrAdmin authz helper
chronoai-shining
authored
dc10df1
[Docs] Correct the stale ENCRYPTION_KEY dev-sentinel claim in config doc
chronoai-shining
authored
91aec31
[Misc] Harden playground actor plumbing (follow-up to #806)
chronoai-shining
authored
137df13
[Misc] Quota reservation follow-ups (follow-up to #808)
chronoai-shining
authored
0cf8f26
[Bug] Re-validate redirect hops in safeFetch to close the SSRF redirect bypass (follow-up to #811)
chronoai-shining
authored
fec8aed
[Bug] setSkillPermissions returns spurious 403 when org memberships are unresolved (follow-up to #815)
chronoai-shining
authored
595b883

Navigation Menu

Repository navigation

Release v0.10.0 - #865

Release v0.10.0#865
chronoai-shining merged 26 commits into
mainfrom
develop

Commits on May 29, 2026

Merge pull request #765 from ChronoAIProject/sync/post-release-v0.9.1

Commits on Jun 4, 2026

ci: extend PR CI to develop-auto + auto-base-guard backstop (#768)

[Bug] Enforce private-skill visibility on playground skill-load (BOLA)

[Bug] Reject path-traversal skill names on the skip_validation import path

[Bug] Atomically reserve quota to prevent concurrent over-cap (TOCTOU)

[Bug] Add a per-user rate limit to POST /playground/chat

[Bug] Bound pagination page to stop unbounded MongoDB skip()

[Bug] Re-resolve outbound hosts at fetch time for SSRF (DNS-rebind) parity

[Bug] Skip idempotency capture for SSE/streaming responses

[Bug] Key anonymous rate limits on a trusted client IP, not raw XFF

[Misc] Back the rate limiter with a shared store (per-pod/restart-reset today)

[Bug] Enforce caller org membership when sharing a skill into an org

[Feature] Full-bleed autoplay video background as the landing hero

[Misc] Redact token/clientSecret/privateKey/accessToken in Pino logs

[Bug] Reject traversal/dot segments in GitHub owner/repo identifiers (mirror + pull)

[Bug] Clamp playground sandbox timeout_secs to the advertised 1-600 range

[Misc] Remove the unused requireOwnerOrAdmin authz helper

[Docs] Correct the stale ENCRYPTION_KEY dev-sentinel claim in config doc

[Misc] Harden playground actor plumbing (follow-up to #806)

[Misc] Quota reservation follow-ups (follow-up to #808)

[Bug] Re-validate redirect hops in safeFetch to close the SSRF redirect bypass (follow-up to #811)

[Bug] setSkillPermissions returns spurious 403 when org memberships are unresolved (follow-up to #815)

Commits on Jun 5, 2026

[Bug] Landing hero text layer clipped at short/wide viewport ratios

Upscale landing hero video to 4K (#862) (#863)

Merge pull request #857 from ChronoAIProject/develop-auto

docs: release notes for v0.10.0 (2026-06-05) (#864)