v3.16.2

ruvnet/ruflov3.16.2Jun 30, 2026by ruvnet

AI Summary

A security-focused PATCH release closing critical CVEs (5 to 0) across workspaces and rewriting the CVE registry to ensure current security posture.

Key Highlights

Closed 5 critical CVEs (vitest, handlebars, protobufjs) across root and v3 workspaces
Added new CI gate (.github/workflows/cve-audit.yml) to block PRs on critical vulnerabilities
Rewrote CVE registry from 5 stale entries to 16 current entries

Full Release Notes

## What's fixed in 3.16.2

PATCH release shipping [ADR-165](https://github.com/ruvnet/ruflo/blob/main/v3/docs/adr/ADR-165-security-cve-posture-review.md) Phase 1 — close every critical CVE in both workspaces.

### Critical-severity advisories closed (5 → 0)

| Workspace | Before | After |
|-----------|--------|-------|
| Root | 1 critical, 6 high, 31 moderate (38 total) | **0 critical**, 0 high, 31 moderate (31 total) |
| v3 | 4 critical, 33 high, 57 moderate (97 total) | **0 critical**, 27 high, 58 moderate (88 total) |

Each critical chain closed:
- **vitest** — GHSA-5xrq-8626-4rwp (CVSS 9.8 — UI server arbitrary file read+exec)
- **handlebars** — prototype-pollution RCE chain (toolchain-only path verified non-user-reachable)
- **protobufjs** — constructor-pollution chain
- Plus 2 additional v3 criticals via overrides

12 of 39 high-severity advisories also closed (the remaining 27 v3 highs need major-bump migrations — flagged for ADR-165 Phase 2).

### Other deliverables in this release

- **CVE registry rewritten**: 5 stale Jan-2026 entries → 16 current entries. `CVE-REMEDIATION.ts::validateRemediation()` now correctly returns `allFixed: false` with 1 known open (ADR165-OPEN-01 — PII pipeline wiring).
- **New CI gate**: `.github/workflows/cve-audit.yml` blocks PRs on any critical, warn-only on high, runs on every PR + push + daily cron.
- **ADR-165 §9 evidence ledger** updated with after-remediation `npm audit` metadata.

### Verified

- 113/113 PR #2508 CI checks green
- 105/109 vitest pass (4 skip-conditional)
- 352/352 MCP tools pass ADR-112 audit
- 11/11 + 8/8 + 8/8 smoke contracts (business-pods, agentbbs, agenticow)
- `npm audit --audit-level=critical` exit 0 in BOTH workspaces

### Install / upgrade

```bash
npx ruflo@latest             # 3.16.2
npx @claude-flow/cli@latest  # 3.16.2
npx claude-flow@latest       # 3.16.2
```

### npm dist-tags

```
@claude-flow/cli  latest=3.16.2  alpha=3.16.2  v3alpha=3.16.2
claude-flow       latest=3.16.2  alpha=3.16.2  v3alpha=3.16.2
ruflo             latest=3.16.2  alpha=3.16.2  v3alpha=3.16.2
```

### Related

- ADR [docs/adr/ADR-165-security-cve-posture-review.md](https://github.com/ruvnet/ruflo/blob/main/v3/docs/adr/ADR-165-security-cve-posture-review.md)
- PR [#2508](https://github.com/ruvnet/ruflo/pull/2508) — fix(security): Phase 1 close-out
- PR [#2509](https://github.com/ruvnet/ruflo/pull/2509) — chore(release): 3.16.1 → 3.16.2

### Phase 2 (next release)

Targets 3.17.0 — automated `cve-watch.yml` + per-tool validator coverage audit + v3 high-severity transitive chain remediation.