v1.4.474

hashicorp/vaultv1.4.474Sep 3, 2026by github-actions[bot]

AI Summary

Significantly improves security by restricting file system access to prevent directory traversal and symlink attacks, requiring API keys for external connections, and hardening the REST server defaults.

Key Highlights

Reject unsafe cross-platform storage names
Confine symlink targets to configured filesystem storage directories
Require API keys for non-loopback server bindings
Validate chat pattern, context, and session names early

New Features

Security hardening for storage and authentication

Full Release Notes

## Changes

### PR [#2206](https://github.com/danielmiessler/Fabric/pull/2206) by [ksylvan](https://github.com/ksylvan): fix: confine storage names and authenticate Ollama serve

- Reject unsafe cross-platform storage names and directory traversal attempts.
- Confine symlink targets to configured filesystem storage directories.
- Require API keys for non-loopback server bindings and authenticate Ollama routes.
- Validate chat pattern, context, and session names early while preventing internal filesystem details from leaking through client errors.
- Default the REST server to loopback port 8080 and add regression coverage for traversal, symlink, and authentication security.