From de22ee14614f53b5b4939ab81b3b89d0d13d2463 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 13:07:06 +0000 Subject: [PATCH] chore(release): version packages --- .changeset/phase-150-git-arg-injection.md | 13 ------ .changeset/phase-151-read-route-authz.md | 15 ------- .changeset/phase-152-byok-ssrf-list-bounds.md | 15 ------- .changeset/phase-153-hash-labeling.md | 5 --- CHANGELOG.md | 40 +++++++++++++++++++ package.json | 2 +- 6 files changed, 41 insertions(+), 49 deletions(-) delete mode 100644 .changeset/phase-150-git-arg-injection.md delete mode 100644 .changeset/phase-151-read-route-authz.md delete mode 100644 .changeset/phase-152-byok-ssrf-list-bounds.md delete mode 100644 .changeset/phase-153-hash-labeling.md diff --git a/.changeset/phase-150-git-arg-injection.md b/.changeset/phase-150-git-arg-injection.md deleted file mode 100644 index e82ba25f..00000000 --- a/.changeset/phase-150-git-arg-injection.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"gitsema": patch ---- - -Security (Phase 150 / review11 §2.1 + §3.2): close the network-reachable git -argument-injection sink. A caller-supplied "ref" beginning with `-` (e.g. -`--output=/path`) was parsed by git as a *flag*, turning `git log` into an -arbitrary-file-write primitive reachable via `semantic_bisect`/`triage`. All -git call sites that take a user-influenced ref now route through a shared -`runGit()` helper that rejects leading-`-` refs before spawning git and always -inserts git's `--end-of-options` separator so a value can never be read as a -flag (`resolveRefToTimestamp`, `parseDateArg`, `getMergeBase`, -`getBranchExclusiveBlobs`). diff --git a/.changeset/phase-151-read-route-authz.md b/.changeset/phase-151-read-route-authz.md deleted file mode 100644 index 23ce5bb5..00000000 --- a/.changeset/phase-151-read-route-authz.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"gitsema": patch ---- - -Security (Phase 151 / review11 §2.2): enforce repo authorization on read -routes. The multi-tenant grant model (`repo_grants` / `resolveUserRepoAccess`) -was defined but never checked on the ~16 search/analysis/evolution/graph/ -insights routes, so any caller could read any repo's indexed content by naming -its `repoId`. A new `repoAuthMiddleware` now runs after `repoSessionMiddleware` -and, in multi-tenant mode, requires the caller to hold a `read` grant on the -addressed repo unless it is `public` (else 403). Multi-tenant mode is opt-in -via `GITSEMA_MULTI_TENANT` (defaulting to `GITSEMA_SERVE_KEY` presence); the -global serve key and legacy per-repo scoped tokens bypass the check, and a -default open single-dev server is unaffected. Repo-level only — per-branch -grant filtering is deferred to a follow-on phase. diff --git a/.changeset/phase-152-byok-ssrf-list-bounds.md b/.changeset/phase-152-byok-ssrf-list-bounds.md deleted file mode 100644 index a3e2a6c5..00000000 --- a/.changeset/phase-152-byok-ssrf-list-bounds.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"gitsema": patch ---- - -Security (Phase 152 / review11 §3.1 + §3.3). **BYOK SSRF guard:** on -`tools serve`, a caller-supplied `byok.http_url` is now validated before the -server calls it — non-`http(s)` schemes and hosts resolving to loopback, -link-local (incl. the `169.254.169.254` cloud-metadata IP), or RFC-1918 -private ranges are rejected by default. Operators re-permit specific internal -hosts (e.g. a local model server) via the new `GITSEMA_BYOK_ALLOW_HOSTS` -allowlist. This is a behavior change for anyone pointing BYOK at a -`localhost`/private endpoint — add the host to the allowlist. **List-tool -bounds:** the network-exposed `deps` and `blast_radius` `depth` parameter is -now upper-bounded (max 64) on both the HTTP route and MCP tool, closing the -last unbounded traversal-depth input from the Phase 147/148 exposure. diff --git a/.changeset/phase-153-hash-labeling.md b/.changeset/phase-153-hash-labeling.md deleted file mode 100644 index 69f34497..00000000 --- a/.changeset/phase-153-hash-labeling.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"gitsema": minor ---- - -Phase 153: Add `blob:` prefix to blob hashes in all text outputs (CLI, MCP, HTTP) so they are clearly distinguishable from commit hashes. HTML renderers now show "Blob Hash" column headers and `blob:`/`commit:` prefixes. OpenAPI `blobHash` field description updated for clarity. MCP tool interpretations for `semantic_search`, `search_history`, and `first_seen` updated to guide LLMs on hash types. diff --git a/CHANGELOG.md b/CHANGELOG.md index f1d507ee..9f20f1e0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,45 @@ # gitsema +## 0.98.0 + +### Minor Changes + +- 1767bff: Phase 153: Add `blob:` prefix to blob hashes in all text outputs (CLI, MCP, HTTP) so they are clearly distinguishable from commit hashes. HTML renderers now show "Blob Hash" column headers and `blob:`/`commit:` prefixes. OpenAPI `blobHash` field description updated for clarity. MCP tool interpretations for `semantic_search`, `search_history`, and `first_seen` updated to guide LLMs on hash types. + +### Patch Changes + +- d06182f: Security (Phase 150 / review11 §2.1 + §3.2): close the network-reachable git + argument-injection sink. A caller-supplied "ref" beginning with `-` (e.g. + `--output=/path`) was parsed by git as a _flag_, turning `git log` into an + arbitrary-file-write primitive reachable via `semantic_bisect`/`triage`. All + git call sites that take a user-influenced ref now route through a shared + `runGit()` helper that rejects leading-`-` refs before spawning git and always + inserts git's `--end-of-options` separator so a value can never be read as a + flag (`resolveRefToTimestamp`, `parseDateArg`, `getMergeBase`, + `getBranchExclusiveBlobs`). +- 842be12: Security (Phase 151 / review11 §2.2): enforce repo authorization on read + routes. The multi-tenant grant model (`repo_grants` / `resolveUserRepoAccess`) + was defined but never checked on the ~16 search/analysis/evolution/graph/ + insights routes, so any caller could read any repo's indexed content by naming + its `repoId`. A new `repoAuthMiddleware` now runs after `repoSessionMiddleware` + and, in multi-tenant mode, requires the caller to hold a `read` grant on the + addressed repo unless it is `public` (else 403). Multi-tenant mode is opt-in + via `GITSEMA_MULTI_TENANT` (defaulting to `GITSEMA_SERVE_KEY` presence); the + global serve key and legacy per-repo scoped tokens bypass the check, and a + default open single-dev server is unaffected. Repo-level only — per-branch + grant filtering is deferred to a follow-on phase. +- 6bf15d8: Security (Phase 152 / review11 §3.1 + §3.3). **BYOK SSRF guard:** on + `tools serve`, a caller-supplied `byok.http_url` is now validated before the + server calls it — non-`http(s)` schemes and hosts resolving to loopback, + link-local (incl. the `169.254.169.254` cloud-metadata IP), or RFC-1918 + private ranges are rejected by default. Operators re-permit specific internal + hosts (e.g. a local model server) via the new `GITSEMA_BYOK_ALLOW_HOSTS` + allowlist. This is a behavior change for anyone pointing BYOK at a + `localhost`/private endpoint — add the host to the allowlist. **List-tool + bounds:** the network-exposed `deps` and `blast_radius` `depth` parameter is + now upper-bounded (max 64) on both the HTTP route and MCP tool, closing the + last unbounded traversal-depth input from the Phase 147/148 exposure. + ## 0.97.0 ### Minor Changes diff --git a/package.json b/package.json index 5fcc9c28..7cc1737f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gitsema", - "version": "0.97.0", + "version": "0.98.0", "description": "A content-addressed semantic index synchronized with Git's object model.", "type": "module", "main": "dist/cli/index.js",