v0.3.8 v1.43.0
imputnet/cobaltAug 9, 2026 → Aug 31, 202622 days between releases
What's New
Newer release appears to be for a different repo (Logto) than older (VulnClaw), featuring SSRF protection and Spanish localization.
Breaking Changes
- Third-party application scopes are revalidated (removing a scope invalidates existing grants)
- SSRF protection blocks private network requests by default (requires configuration)
- Third-party applications can no longer mutate account data via the Account API
New Features
- SSRF protection for webhooks and enterprise SSO connectors
- Token exchange validation ensures JWTs are valid access tokens
- Spanish (Mexico) localization support with phone number defaults
- Azure AD connector now supports disabling email sync
- Webhook delivery retry logic
Improvements
- Security hardening measures including SSRF protection
- Token exchange validation to prevent invalid subject tokens
Bug Fixes
- Fixes for list formatter placeholders
- Fixes for untranslated MFA message in Spanish locales
- Resolves various bugs in authentication workflows and account management
Upgrade Notes
The older release notes describe a Rust TUI tool (VulnClaw), while the newer notes describe an authentication platform (Logto). These appear to be different repositories. If upgrading between these specific versions, note that the features are unrelated. For the newer Logto release, configure SSRF protection if blocking private networks is undesired.
The Two Releases
v0.3.8
Aug 9, 2026· 2 months ago
A major update featuring a complete移植 to the Rust ratatui TUI, bilingual UI support, local Ollama integration, and critical fixes for MCP runtime stability and context management.
Full release notesv1.43.0
Aug 31, 2026· 2 months ago
This release introduces significant security hardening measures, such as SSRF protection and stricter token validation, alongside new localization support for Spanish (Mexico). It also resolves various bugs in authentication workflows and account management.
Full release notes