Starstruk Logo MarkStarstruk

v3.57.1

ruvnet/ruflov3.57.1Oct 19, 2026by ruvnet

Upgrading?

What changed from v3.57.0 → v3.57.1?What's new in v3.57.2 after v3.57.1?

AI Summary

This patch release focuses on security hardening for environment variables and fixes native bundle drift issues that were causing smoke test failures and Windows compatibility problems.

Key Highlights

  • Expanded the environment variable denylist to block additional credential and command-hijacking variables.
  • Fixed native bundle drift failures in adr, ddd, and sparc codex-mod hooks.
  • Resolved a hard-fail issue in the hook building script on Windows systems.
  • Updated @claude-flow/cli-core to version 3.7.4.

New Features

  • Added support for blocking git's numbered configuration variables (GIT_CONFIG_COUNT, KEY_*, VALUE_*) via regex.
  • Extended the denylist to include interpreter-flag-injection variables like JAVA_TOOL_OPTIONS, PYTHONHOME, and RUBYOPT.

Full Release Notes

Patch release: `@claude-flow/cli`, `claude-flow`, `ruflo` 3.57.1. `@claude-flow/cli-core` 3.7.4 (#4229, #4230) was published earlier and is pinned exactly.

### Security

- `DENYLISTED_ENV_NAMES` now blocks the credential/command-hijack and interpreter-flag-injection vars that 2026-09-21's env-sanitizer fix missed: `GIT_ASKPASS`, `GIT_PROXY_COMMAND`, `GIT_CONFIG_NOSYSTEM`, `PERL5OPT`, `RUBYOPT`, `JAVA_TOOL_OPTIONS`, `_JAVA_OPTIONS`, `JDK_JAVA_OPTIONS`, `PYTHONHOME`, `CLASSPATH`, `PYTHONSTARTUP`, plus git's numbered `GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+)` family via a new regex (`cli-core` 3.7.4, #4229, #4230).

### Fixed

- `all-plugins-smoke`: the adr/ddd/sparc codex-mod native hook bundles are rebuilt, clearing the native-bundle-drift failure that had been hitting every push to `main`; `scripts/build-codex-mod-hooks.mjs` also no longer hard-fails on Windows, where `execFileSync` can't invoke a `.cmd` shim directly (#4266, #4277, @uyg7x).

Related Repositories

openclaw/openclaw★ 392,696

The AI that really does things. Any OS. Any Platform. The lobster way. 🦞

nilbuild/developer-roadmap★ 370,067

Interactive roadmaps, guides and other educational content to help developers grow in their careers.

morluto/rea★ 357,700

Reverse engineer anything with agents, from app behavior down to native binaries.

anomalyco/opencode★ 219,670

The open source coding agent.

n8n-io/n8n★ 208,251

Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.