Repository navigation
Release 2.14.0: merge v2/main into main again for the security fixes #2881
Description
Second milestone merge of v2/main into main for v2.14.0. It brings in the three security fixes that landed on v2/main after #2867 merged:
- [GHSA-h9j8-vj8g-v3gg] - MCP App escapes its CSP by navigating its own frame #2872 / PR fix(web): stop an MCP App navigating its sandbox frame elsewhere #2875
- [GHSA-rwv7-mh2c-ff2p] - Unvalidated server.json import args, elicitation URL scheme, preview CSP injection #2873 / PR fix: harden server.json import review, URL elicitation scheme, and preview CSP injection #2876
- [GHSA-2fw8-7jmw-r937] - Tool outputSchema pattern can stall validation (ReDoS) #2874 / PR fix(core): evaluate server-supplied schema patterns in bounded time (v2) #2877
The release is held until these are on main, so 2.14.0 ships with them. Per the release skill, step 2:
- The merge tree must equal
origin/v2/main^{tree}. npm run local:gateandnpm run pack:verifymust pass on the merge tree.- The three fixes get smoke rows from the production build, added to the v2.14.0 ledger.
Activity
cliffhall commentedon Nov 4, 2026
Triage: Priority Urgent (total 12)
Board: #28, Status
In Progress.