v1.91.0

deepfakes/faceswapv1.91.0Jul 7, 2026by autogame-17

AI Summary

This release focuses on security hardening by preventing command injection in the self-PR flow and enforcing strict encryption standards for coding-trajectory exports.

Key Highlights

Self-evolution PR flow hardened against command injection
AES-256-GCM auth-tag length pinned on coding-trajectory export
Test-fixture hygiene improvements via Gitleaks allowlist

Full Release Notes

## v1.91.0 — Security hardening

This is a security-hardening patch. No public API or behavioral changes for normal use; recommended for all users.

- **Self-evolution PR flow hardened against command injection.** All `git` / `gh` subprocesses in the self-PR path are now invoked via argv (no shell), so a model- or hub-generated mutation rationale, branch name, or file path can no longer reach a shell. (#304)
- **AES-256-GCM auth-tag length pinned on the coding-trajectory export decrypt path.** A truncated-tag envelope is now rejected instead of being accepted with a weaker authenticator. (#317)
- **Test-fixture hygiene.** Completed the Gitleaks allowlist for the redaction-test fixtures (no runtime change). (#317)