v1.4.474

swc-project/swcv1.4.474Sep 3, 2026by github-actions[bot]

AI Summary

This release focuses on security hardening for storage handling and authentication within the Ollama serve context. It introduces stricter validation for storage names and directory traversal attempts while enforcing API key requirements for non-loopback bindings.

Key Highlights

Reject unsafe cross-platform storage names and directory traversal attempts
Confine symlink targets to configured filesystem storage directories
Require API keys for non-loopback server bindings and authenticate Ollama routes
Validate chat pattern, context, and session names early
Default the REST server to loopback port 8080

New Features

Security hardening for storage names and authentication
Confine symlink targets to configured directories
Require API keys for non-loopback server bindings
Validate chat pattern, context, and session names early

Full Release Notes

## Changes

### PR [#2206](https://github.com/danielmiessler/Fabric/pull/2206) by [ksylvan](https://github.com/ksylvan): fix: confine storage names and authenticate Ollama serve

- Reject unsafe cross-platform storage names and directory traversal attempts.
- Confine symlink targets to configured filesystem storage directories.
- Require API keys for non-loopback server bindings and authenticate Ollama routes.
- Validate chat pattern, context, and session names early while preventing internal filesystem details from leaking through client errors.
- Default the REST server to loopback port 8080 and add regression coverage for traversal, symlink, and authentication security.