Starstruk Logo MarkStarstruk

v1.91.0

parruda/swarmv1.91.0Jul 7, 2026by autogame-17

AI Summary

A security-hardening patch with no public API or behavioral changes for normal use.

Key Highlights

  • Hardened self-evolution PR flow against command injection
  • Pinned AES-256-GCM auth-tag length on export decrypt path
  • Completed Gitleaks allowlist for redaction-test fixtures

Full Release Notes

## v1.91.0 — Security hardening

This is a security-hardening patch. No public API or behavioral changes for normal use; recommended for all users.

- **Self-evolution PR flow hardened against command injection.** All `git` / `gh` subprocesses in the self-PR path are now invoked via argv (no shell), so a model- or hub-generated mutation rationale, branch name, or file path can no longer reach a shell. (#304)
- **AES-256-GCM auth-tag length pinned on the coding-trajectory export decrypt path.** A truncated-tag envelope is now rejected instead of being accepted with a weaker authenticator. (#317)
- **Test-fixture hygiene.** Completed the Gitleaks allowlist for the redaction-test fixtures (no runtime change). (#317)