Starstruk Logo MarkStarstruk

11.0.313

Agenta-AI/agenta11.0.313Aug 8, 2026by adubovikov

AI Summary

This release focuses on security hardening, specifically improving authentication for the node `/query` endpoint and blocking potential SQL injection vectors.

Key Highlights

  • Hardened node `/query` authentication with Bearer support and auto-token on non-loopback binds.
  • Blocked `sqlite_scan` and other DuckDB external scanners in `ValidateRawSQL`.
  • Enforced `ValidateRawSQL` for all Node HTTP `POST /query` requests.
  • Implemented auto-token generation for coordinator-to-node communication.

New Features

  • SQL scanner blocking mechanism
  • Bearer authentication for node endpoints
  • Enhanced SQL validation for HTTP queries

Full Release Notes

## What's Changed
* fix(security): harden node `/query` auth and block `sqlite_scan` by @adubovikov in https://github.com/sipcapture/homer/pull/927

### Security
- **GHSA-rm5w-rqr7-2h54**: Node HTTP `POST /query` (port+1) now always runs `ValidateRawSQL`; Bearer auth when `flight_server.auth_token` is set; auto-token on non-loopback binds (`.homer_node_auth_token`). Coordinator sends `nodes[].token`.
- **GHSA-4687-q698-mccv**: Block `sqlite_scan` and other DuckDB external scanners in `ValidateRawSQL`.

See [SECURITY.md](https://github.com/sipcapture/homer/blob/homer11/docs/SECURITY.md).

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.312...11.0.313