v0.6.0 v1.16.22
multica-ai/multicaSep 28, 2026 → Sep 28, 20260 days between releases
What's New
Hardened web server requires allowed_hosts config and re-approval for worktree hooks
Breaking Changes
- Web server now rejects requests from unauthorized hostnames unless configured in [web] allowed_hosts
- Worktree hook approvals from v1.16.21 and earlier are invalid and require re-approval
New Features
- Web server host validation with allowed_hosts configuration
- HttpOnly, SameSite=Strict cookies for token authentication
- Worktree hook approval bound to script identity (sha256, path, execution method)
- Enhanced input validation and security
Improvements
- Updated web test tooling
- Vitest bumped to 4.1.11
Upgrade Notes
Configure [web] allowed_hosts if accessing via reverse proxy or Tailscale to avoid 421 errors. Re-approve all worktree hooks as approvals from v1.16.21 and earlier no longer include interpreter or path details.
The Two Releases
v0.6.0
Sep 28, 2026· 24 days ago
Major UI overhaul with issue deliverables, dynamic blocks, attachment viewer improvements, and local search index. Added Claude Opus 5.5 and GPT-6 to fallback catalogs, and enhanced Mermaid preview support.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
Hardened web server with host validation and HttpOnly cookies. Changed worktree hook approval to require script identity (sha256, path, and execution method). Updated web test tooling.
Full release notes