Starstruk Logo MarkStarstruk

iii/v0.21.8

iii-hq/iiiiii/v0.21.8Jul 22, 2026by iii-hq-ci[bot]

AI Summary

A patch release addressing critical security vulnerabilities (SSRF) and fixing SDK/browser issues, including the removal of a deprecated async method.

Key Highlights

  • Fixed SSRF bypass vulnerability via IPv4-mapped IPv6 addresses.
  • Restored iii-queue as an opt-in engine builtin.
  • Fixed WebSocket connection handling and half-open socket detection.
  • Removed deprecated RegisterFunction::new_async_with_bad_request method.

Breaking Changes

  • Dropped RegisterFunction::new_async_with_bad_request in the SDK refactor.

New Features

  • Recoverable triggers
  • Console injectable UI

Full Release Notes

## What's Changed
* refactor: remove blog module and related assets, update workspace and… by @sergiofilhowz in https://github.com/iii-hq/iii/pull/1955
* Docs/api docs review by @anthonyiscoding in https://github.com/iii-hq/iii/pull/1961
* fix(iii-browser-sdk): export IIIReconnectionConfig and RegisterFunctionFormat by @anthonyiscoding in https://github.com/iii-hq/iii/pull/1960
* fix(browser-sdk): generate invocation UUIDs in insecure contexts by @ytallo in https://github.com/iii-hq/iii/pull/1964
* fix(engine,iii-worker): restore iii-queue as an opt-in engine builtin by @ytallo in https://github.com/iii-hq/iii/pull/1967
* feat: recoverable triggers by @sergiofilhowz in https://github.com/iii-hq/iii/pull/1962
* refactor(sdk-rust)!: drop RegisterFunction::new_async_with_bad_request by @andersonleal in https://github.com/iii-hq/iii/pull/1966
* fix: SSRF bypass via IPv4-mapped IPv6 addresses in url_validator by @Pranjal0410 in https://github.com/iii-hq/iii/pull/1965
* fix(engine,iii-worker): pass engine's actual WS address to spawned builtin daemons (MOT-3970) by @andersonleal in https://github.com/iii-hq/iii/pull/1974
* fix(node-sdk): bound WebSocket connects and detect half-open sockets (MOT-3968) by @andersonleal in https://github.com/iii-hq/iii/pull/1973
* feat(python-sdk): add III.add_connection_state_listener; warn on connect-wait timeout (MOT-3969) by @andersonleal in https://github.com/iii-hq/iii/pull/1956
* fix(engine): idle-timeout accepted worker WS sockets that never complete the upgrade (MOT-3967) by @andersonleal in https://github.com/iii-hq/iii/pull/1972
* fix(engine,rust-sdk): supervise external workers and harden SDK reconnect (MOT-3857) by @andersonleal in https://github.com/iii-hq/iii/pull/1978
* fix(iii-worker): worker CLI operation fixes (remove, status, clear, update, logs, sandbox) by @ytallo in https://github.com/iii-hq/iii/pull/1971
* fix(iii-network,sdk-python): first-boot worker zombies — VM transport wake starvation + SDK reconnect death (MOT-3966) by @andersonleal in https://github.com/iii-hq/iii/pull/1979
* fix(ci): build alpha release binaries from tagged commit by @guibeira in https://github.com/iii-hq/iii/pull/1981
* chore(worker): warn about deprecated builtin names by @guibeira in https://github.com/iii-hq/iii/pull/1980
* fix(node-sdk,browser-sdk): default trigger generics so untyped calls pass tsc (MOT-4076) by @ytallo in https://github.com/iii-hq/iii/pull/1982
* fix: dx issues by @sergiofilhowz in https://github.com/iii-hq/iii/pull/1970
* docs: remove iii prefix from some migrated workers by @anthonyiscoding in https://github.com/iii-hq/iii/pull/1969
* Show install command in alpha release notes by @guibeira in https://github.com/iii-hq/iii/pull/1989
* Show package install commands in alpha releases by @guibeira in https://github.com/iii-hq/iii/pull/1990
* fix(engine): reject duplicate migrated builtin workers by @guibeira in https://github.com/iii-hq/iii/pull/1983
* feat(website): export blog markdown for agents by @rohitg00 in https://github.com/iii-hq/iii/pull/1934
* fix(website): wire blog markdown export into the build and target the website dist by @rohitg00 in https://github.com/iii-hq/iii/pull/1994
* feat(iii-worker): accept registry tags in manifests by @rohitg00 in https://github.com/iii-hq/iii/pull/1977
* fix(engine,sdk): worker reconnect ownership kill loop (MOT-4025, iii#1975) by @andersonleal in https://github.com/iii-hq/iii/pull/1993
* let ccbot crawl us for training data by @anthonyiscoding in https://github.com/iii-hq/iii/pull/1997
* docs: align docs/next with 0.21→0.22 breaking changes by @anthonyiscoding in https://github.com/iii-hq/iii/pull/1996
* feat(spec): console injectable ui by @sergiofilhowz in https://github.com/iii-hq/iii/pull/1995
* fix(engine): park undeliverable trigger binds instead of dropping them (MOT-4081) by @andersonleal in https://github.com/iii-hq/iii/pull/1988
* fix(iii-worker): hostless worker add from a non-project dir targets the running engine (MOT-4091) by @ytallo in https://github.com/iii-hq/iii/pull/1992
* fix(engine,iii-worker): propagate manager port to registry binary workers (MOT-4149) by @andersonleal in https://github.com/iii-hq/iii/pull/2000
* feat(website): add blog post on loops, graphs, and the layer that matters by @rohitg00 in https://github.com/iii-hq/iii/pull/2002
* feat(website): use each blog post banner as its own og:image by @rohitg00 in https://github.com/iii-hq/iii/pull/2003
* docs: fix linkly config-file steps and quickstart worker-add output by @anthonyiscoding in https://github.com/iii-hq/iii/pull/2004
* fix(iii-worker): count nodes not paths in dep graph bounds check by @guibeira in https://github.com/iii-hq/iii/pull/2005
* docs(changelog): 0.22.0 release notes by @guibeira in https://github.com/iii-hq/iii/pull/1998
* fix(engine): repair protocol_serde_bench compilation by @guibeira in https://github.com/iii-hq/iii/pull/2007

## New Contributors
* @Pranjal0410 made their first contribution in https://github.com/iii-hq/iii/pull/1965

**Full Changelog**: https://github.com/iii-hq/iii/compare/iii/v0.21.6...iii/v0.21.8