Repository navigation

fix(security): backport upstream v1.18 hardening for debug config, browser URLs and OAuth pages - #1507

Open

anandgupta42 wants to merge 16 commits into

mainfrom

fix/v1-security-backports

Open

fix(security): backport upstream v1.18 hardening for debug config, browser URLs and OAuth pages#1507
anandgupta42 wants to merge 16 commits into
mainfrom
fix/v1-security-backports

Commits on Oct 16, 2026
- fix(security): backport upstream v1.18 hardening for debug config, browser URLs and OAuth pages
  
  anandgupta42
  and
  claude
  committed
  0b03c73
- fix(security): refuse non-http(s) Snowflake SSO URLs; record core `open` in bun.lock
  
  anandgupta42
  and
  claude
  committed
  c4a03d0
- fix(security): redact credentials in any-scheme URLs and argv in debug config
  
  anandgupta42
  and
  claude
  committed
  4d7e7ce
- fix(security): mask every URL query and fragment value in debug config
  
  anandgupta42
  and
  claude
  committed
  c432a17
- fix(security): redact every value nested under a secret-named key
  
  anandgupta42
  and
  claude
  committed
  b1996f2
- fix(security): mask MCP environment values and argv arguments in debug config
  
  anandgupta42
  and
  claude
  committed
  92aee8d
- fix(markers): do not nest backport markers inside existing marker blocks
  
  anandgupta42
  and
  claude
  committed
  2abadef
- fix(security): keep only the executable in MCP argv; drop server URL from OAuth error
  
  anandgupta42
  and
  claude
  committed
  20e6593
- fix(security): close `debug config` redaction gaps from local review
  
  anandgupta42
  and
  claude
  committed
  e12b3d4
- fix(security): print only the origin of remote server URLs in `debug config`; keep prose with links
  
  anandgupta42
  and
  claude
  committed
  c2d2bc3
- fix(security): keep redacting scheme-prefixed URLs that contain spaces
  
  anandgupta42
  and
  claude
  committed
  d8b84bc
- fix(security): treat any scheme-prefixed value as a URL in `debug config`, even with spaces
  
  anandgupta42
  and
  claude
  committed
  7743682
- fix(security): print only the origin of provider endpoint URLs in `debug config`
  
  anandgupta42
  and
  claude
  committed
  55ccdc6
- fix(security): keep unparseable endpoint values fully masked in `debug config`
  
  anandgupta42
  and
  claude
  committed
  f9ab4d0
- fix(security): apply endpoint masking only to address-like values
  
  anandgupta42
  and
  claude
  committed
  07816fa
- fix(security): treat backslash and colon as address characters for endpoint masking
  
  anandgupta42
  and
  claude
  committed
  14e5145

Commits

Commits on Oct 16, 2026