Repository navigation

release: prepare v2.13.0 security and blocking fixes - #833

Merged

yashrajp22 merged 66 commits into

yashraj/v2.13.0-basefrom

yashraj/release-v2.13.0

Oct 16, 2026

Merged

release: prepare v2.13.0 security and blocking fixes#833
yashrajp22 merged 66 commits into
yashraj/v2.13.0-basefrom
yashraj/release-v2.13.0

Commits on Oct 14, 2026
- fix(analyzer): flag settings keys that run commands or reroute traffic (#604)
  
  deepujain
  authored and
  yashrajp22
  committed
  cbc6900
- fix(patterns): detect constructed sensitive paths (#545)
  
  deepujain
  authored and
  yashrajp22
  committed
  c9b05e2
- fix(discovery): report skipped symlinked skills (#499)
  
  deepujain
  authored and
  yashrajp22
  committed
  29c58a4
- fix: strip leading BOM before SKILL.md frontmatter detection (#471)
  
  MohammedAlkindi
  authored and
  yashrajp22
  committed
  0c0cba4
- fix: detect bidi control characters outside markdown files (CVE-2021-42574) (#473)
  
  MohammedAlkindi
  authored and
  yashrajp22
  committed
  6f5c175
- Merge pull request #595 from bniladridas/bniladridas/symlink-omission
  
  rng1995
  authored and
  yashrajp22
  committed
  7438b48
- Merge pull request #661 from NVIDIA/naren/fix-ae1-missing-reference-source
  
  rng1995
  authored and
  yashrajp22
  committed
  fe95403
- Merge pull request #634 from deepujain/fix/628-shell-assignment-quote-ownership
  
  rng1995
  authored and
  yashrajp22
  committed
  83aca7a
- Merge pull request #686 from NVIDIA/naren/fix-parameter-operator-parse-limit
  
  rng1995
  authored and
  yashrajp22
  committed
  380997d
- Merge pull request #637 from drakeo338/claude/633-baseline-every-occurrence
  
  rng1995
  authored and
  yashrajp22
  committed
  16ca512
- Merge pull request #655 from udsy19/fix/node-options-require-short-flag
  
  rng1995
  authored and
  yashrajp22
  committed
  2d0c385
- Merge pull request #700 from Harbor404/fix/sc2-stdin-consumer-false-positive
  
  rng1995
  authored and
  yashrajp22
  committed
  f4ede2f
- Merge pull request #702 from Harbor404/fix/meta-review-finding-binding
  
  rng1995
  authored and
  yashrajp22
  committed
  a4adfcc
- Merge pull request #601 from efegokdemir/codex/issue-585-declaration-executable
  
  rng1995
  authored and
  yashrajp22
  committed
  ee2323c
- Merge pull request #632 from deepujain/fix/629-plugin-json-hooks
  
  rng1995
  authored and
  yashrajp22
  committed
  41308a9
- Merge pull request #627 from NVIDIA/codex/fix-prose-shell-parser-context
  
  rng1995
  authored and
  yashrajp22
  committed
  473ef7a
- Merge pull request #623 from NVIDIA/codex/fix-missing-python-ast-columns
  
  rng1995
  authored and
  yashrajp22
  committed
  04f713f
- Merge pull request #593 from udsy19/fix/yara-reverse-shell-multiline
  
  rng1995
  authored and
  yashrajp22
  committed
  a0a0f6c
- Merge pull request #740 from NVIDIA/yashraj/fix-xor-key-regex-backtracking
  
  rng1995
  authored and
  yashrajp22
  committed
  671347f
- Merge pull request #744 from NVIDIA/yashraj/restrict-mcp-http-loopback
  
  rng1995
  authored and
  yashrajp22
  committed
  8a71faf
- Merge pull request #746 from NVIDIA/yashraj/pin-release-checkout
  
  rng1995
  authored and
  yashrajp22
  committed
  a12ac8d
- Merge pull request #729 from YMuskrat/fix/prevent-input-overwrite
  
  rng1995
  authored and
  yashrajp22
  committed
  fdc6eae
- Merge pull request #733 from NVIDIA/yashraj/fix-batch-markdown-output-20261005
  
  rng1995
  authored and
  yashrajp22
  committed
  2f14287
- Merge pull request #611 from udsy19/fix/taint-source-order
  
  rng1995
  authored and
  yashrajp22
  committed
  5dd32db
- Merge pull request #735 from NVIDIA/yashraj/fix-markdown-report-output-20261005
  
  rng1995
  authored and
  yashrajp22
  committed
  55a177b
- Merge pull request #736 from NVIDIA/yashraj/isolate-http-mcp-git-credentials
  
  rng1995
  authored and
  yashrajp22
  committed
  260a24f
- Merge pull request #737 from NVIDIA/yashraj/disable-unsafe-codex-provider
  
  rng1995
  authored and
  yashrajp22
  committed
  ffc6bbf
- Merge pull request #748 from NVIDIA/yashraj/refresh-nvidia-build-default
  
  rng1995
  authored and
  yashrajp22
  committed
  f4c8815
- Merge pull request #738 from NVIDIA/yashraj/allowlist-agent-cli-environment
  
  rng1995
  authored and
  yashrajp22
  committed
  f7ba248
- Merge pull request #745 from NVIDIA/yashraj/redact-short-opencode-credentials
  
  rng1995
  authored and
  yashrajp22
  committed
  56488eb
- Merge pull request #734 from NVIDIA/yashraj/fix-batch-terminal-output-20261005
  
  rng1995
  authored and
  yashrajp22
  committed
  4fcb695
- Merge pull request #739 from NVIDIA/yashraj/fix-pi-redaction-runtime-20261005
  
  rng1995
  authored and
  yashrajp22
  committed
  f95b8cd
- fix(static): decode provable printf escapes in shell literals (#704)
  
  Harbor404
  authored and
  yashrajp22
  committed
  168e840
- fix: prefer tool output for OpenAI Opus 5 TP4 (#691)
  
  authored and
  yashrajp22
  committed
  c48064f
- fix(analyzer): detect bound shell truthiness (#577)
  
  authored and
  yashrajp22
  committed
  9279b1e
- fix(static_yara): surface dropped rule files instead of reporting completed (#557)
  
  authored and
  yashrajp22
  committed
  de72c52
- fix(analyzer): stabilize TM1 window identity (#578)
  
  authored and
  yashrajp22
  committed
  b5e2da8
- fix(baseline): preserve exact findings and protect baseline output (#657)
  
  authored and
  yashrajp22
  committed
  a716989
- feat(python): classify executable source surfaces (#579)
  
  authored and
  yashrajp22
  committed
  2998a19
- fix(taint): detect inline urllib opener network sinks (#721)
  
  agentsope
  authored and
  yashrajp22
  committed
  95d2375
- Merge pull request #791 from NVIDIA/yashraj/fix-pi-input-permissions-20261007
  
  mohgupta-ship-it
  authored and
  yashrajp22
  committed
  ea80c62
- Merge pull request #792 from NVIDIA/yashraj/isolate-transitive-content-cache
  
  mohgupta-ship-it
  authored and
  yashrajp22
  committed
  5332960
- fix(static): detect shell decode-and-execute chains (#786)
  
  authored and
  yashrajp22
  committed
  4934863
- fix: preserve malformed LLM responses as incomplete analysis (#796)
  
  yashrajp22
  and
  github-actions[bot]
  committed
  0edacd6
- Merge pull request #799 from NVIDIA/naren/fix-tt3-function-scope
  
  rng1995
  authored and
  yashrajp22
  committed
  d1d5118
- Merge pull request #802 from efegokdemir/codex/skill-800-scope-exclusion-accounting
  
  rng1995
  authored and
  yashrajp22
  committed
  165e1b5
- Merge pull request #758 from YMuskrat/ymuskrat/registry-output-guard
  
  rng1995
  authored and
  yashrajp22
  committed
  0c60498
- Merge pull request #767 from NVIDIA/yashraj/release-checkout-credential-followup-20261006
  
  rng1995
  authored and
  yashrajp22
  committed
  6b2dd8c
- fix(release): complete structured-output backport prerequisites
  yashrajp22
  committed
  c0c86b9
- fix(baseline): keep shared-file updates atomic
  yashrajp22
  committed
  998ba92
- release: prepare selected v2.13.0 security and blocking fixes
  yashrajp22
  committed
  057bd1e
- test(release): align regression mocks with retained synchronous TP4
  yashrajp22
  committed
  35b2939
- docs(release): describe the selected registry output guard
  yashrajp22
  committed
  1c5359c
- fix(release): keep static verification independent of LLM providers
  yashrajp22
  committed
  eef7605
- fix: bound TypeScript declaration recognition
  yashrajp22
  committed
  3656d1b
- docs: clarify v2.13.0 scope and verification
  yashrajp22
  committed
  352a36f
Commits on Oct 15, 2026
Commits on Oct 16, 2026
- Merge pull request #844 from NVIDIA/yashraj/fix-release-scan-regressions-20261015
  
  mohgupta-ship-it
  authored and
  yashrajp22
  committed
  2783520
- Merge pull request #795 from NVIDIA/yashraj/scan-unverified-oms-content
  
  rng1995
  authored and
  yashrajp22
  committed
  8ebd201
- Merge pull request #828 from NVIDIA/naren/fix-sc8-thread-time-budget
  yashrajp22
  committed
  92799a7
- Merge pull request #794 from NVIDIA/yashraj/fix-printable-magic-evasion-20261007
  yashrajp22
  committed
  a44f6f3
- docs(release): include final scan hardening and runtime fixes
  yashrajp22
  committed
  e0c568f

Commits

Commits on Oct 14, 2026

Commits on Oct 15, 2026

Commits on Oct 16, 2026