From 0a076e9c166f636117c2e889bba1cde75bbf7f13 Mon Sep 17 00:00:00 2001 From: Dani Date: Wed, 29 Jul 2026 13:53:10 -0400 Subject: [PATCH] docs(changelog): state the 1.2.0 regression and CWE-22 affected range MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 1.1.4 section now describes the code shipped as everos==1.1.4 on PyPI, which lists the path traversal as fixed. Read top-down, that left a 1.2.0 user concluding the fix predates their version and they are safe — the opposite of the truth, since 1.2.0 was built from a branch that never received those fixes. Three changes, no history rewritten: - The 1.2.1 Fixed entry now names what 1.2.0 regressed, instead of describing the merge as internal branch hygiene. - A Security section under 1.2.1 carries the affected-version range, which is discontinuous: everything before 1.1.4, plus 1.2.0. 1.1.4 itself is not affected. - A note under 1.2.0 points forward, so a reader who looks up their own version rather than the newest one still finds it. Matches the published v1.2.1 release notes. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dcf31c1e..6b2c2756 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -101,11 +101,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed -- **1.1.4 fixes backfilled into `main`** — the internal release lane's - fixes (knowledge upload path traversal / CWE-22, cascade retry - classification + total-retry budget, delete/modify race, embedding - empty-data guard, episode extraction retries) were merged back into - the public `main` branch so subsequent releases build on top of them. +- **Fixes present in `1.1.4` but missing from `1.2.0`** — cascade retry + classification + total-retry budget, the delete/modify race, the + embedding empty-data guard, and episode extraction retries (each + detailed under 1.1.4) were absent from the branch `1.2.0` was built + from, so `1.2.0` regressed to pre-1.1.4 behaviour on all of them. See + Security below for the path traversal. - **Filename validation on knowledge upload** — NUL byte and > 255-byte UTF-8 filenames now fail fast with `InvalidInputError → HTTP 400` instead of surfacing OS errors as 500 with a half-written md file. @@ -123,8 +124,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **README "Star us" section** — cleanup. +### Security + +- **Knowledge upload path traversal (CWE-22)** — see the 1.1.4 entry for + the fix description. **Affected:** every release before `1.1.4`, and + `1.2.0`. **Not affected:** `1.1.4`. **Fixed in:** `1.2.1`. The fix + shipped in `1.1.4` but was not present on the branch `1.2.0` was built + from, so upgrading `1.1.4` → `1.2.0` reintroduced it. + ## [1.2.0] - 2026-07-24 +> This release is missing fixes that shipped in `1.1.4`, including a +> knowledge-upload path traversal (CWE-22). See the Security section +> under 1.2.1 for the affected-version range. + ### Added - **`/api/v2` API prefix** — every business endpoint (`memory/*`, `ome/*`,