v4.3.0

camel-ai/camelv4.3.0May 5, 2026by sinewaveai

AI Summary

This release focuses on critical security patches and reliability improvements, addressing a fail-open vulnerability and patching eight Hono CVEs. It also includes bug fixes for case sensitivity and SARIF generation alongside updates to core dependencies.

Key Highlights

Critical fail-open vulnerability fix in GitHub Actions
Patch of 8 Hono CVEs including XSS, path traversal, and authentication bypass
Update of core dependencies including Hono, Vite, and Lodash
Fix for confidence threshold filtering case sensitivity
Addition of 18 new regression tests

New Features

Fix fail-open vulnerability in GitHub Actions
Patch 8 Hono CVEs (XSS, path traversal, auth bypass)
Fix confidence threshold filtering case sensitivity
Fix SARIF generation for GitHub Code Scanning

Full Release Notes

## 🔒 Critical Security & Reliability Fixes

### Security Updates
- **CRITICAL:** Fix fail-open vulnerability in GitHub Actions that could bypass security gates (#71)
- **CRITICAL:** Patch 8 Hono CVEs including XSS, path traversal, and authentication bypass (#75, #66, #65, #64, #62)
  - GHSA-69xw-7hcm-h432: HTML injection via unvalidated JSX tag names
  - GHSA-9vqf-7f2p-gf9v: bodyLimit() bypass for chunked requests
  - GHSA-458j-xx4x-4375: Improper JSX attribute name handling
  - GHSA-wmmm-f939-6g9c: Middleware bypass via repeated slashes
  - GHSA-xf4j-xp2r-rqqx: Path traversal in toSSG()
  - GHSA-xpcf-pg52-r92g: IPv4-mapped IPv6 address bypass
  - GHSA-26pp-8wgv-hjvm: Missing cookie name validation
  - GHSA-r5rp-j6wh-rvv4: Cookie prefix bypass

### Bug Fixes
- Fix confidence threshold filtering case sensitivity (#73)
- Fix SARIF generation for GitHub Code Scanning (#72)

### Dependencies
- Update Hono 4.12.7 → 4.12.16
- Update @hono/node-server to 1.19.13
- Update Vite to 7.3.2
- Update Lodash 4.17.23 → 4.18.1
- Update PostCSS, path-to-regexp, picomatch

### Testing
- Add 18 new regression tests for critical fixes
- All 420+ tests passing

**⚠️ Upgrade recommended for production use.**

See [CHANGELOG.md](https://github.com/sinewaveai/agent-security-scanner-mcp/blob/main/CHANGELOG.md#430---2026-05-05) for complete details.

## Installation

```bash
npm install -g agent-security-scanner-mcp@4.3.0
```

## What Changed
- 18 PRs merged (3 critical bug fixes + 15 security dependency updates)
- 100% backward compatible
- No breaking changes