Skip to content

Release 1.1.1 - #11

Merged
dennisdornon merged 3 commits into
mainfrom
release/v1.1.1
Jul 27, 2026
Merged

Release 1.1.1#11
dennisdornon merged 3 commits into
mainfrom
release/v1.1.1

Conversation

@dennisdornon

@dennisdornon dennisdornon commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Version bump to 1.1.1 and the changelog cut for the security patch release. The Unreleased entries move to [1.1.1] - 2026-07-27 unchanged; the breaking MAINWP_APP_PASSWORD identity-binding note leads the section. Footer compare links updated for the new tag.

No code changes. Publish runs from the v1.1.1 tag after the tarball proof, per the release train.

Summary by CodeRabbit

  • Breaking Changes
    • Password identity binding is now stricter: credentials won’t be sent unless the dashboard identity is set and matches, affecting certain interactive/display-only scenarios.
  • Security
    • Hardened authentication prompts/output to reduce credential exposure and improve validation safety.
    • Added safeguards to prevent excessive resource use during scanning/regex/stream work and tightened handling of escape sequences.
  • Documentation
    • Updated troubleshooting guidance to reference version 1.1.1 and the post-upgrade authentication behavior.
  • Chores
    • Released version 1.1.1 and refreshed the changelog entry and compare links.

Version bump and changelog cut for the security patch release. The
Unreleased entries move to [1.1.1] unchanged, with the breaking
MAINWP_APP_PASSWORD identity-binding note leading the section.
@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ae5e1515-d458-442e-9f66-5167a78ea2b9

📥 Commits

Reviewing files that changed from the base of the PR and between 4fbeca4 and 98245d8.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The package version changes to 1.1.1. The changelog adds the dated release and comparison links, while troubleshooting guidance updates its upgrade reference to 1.1.1.

Changes

Release metadata

Layer / File(s) Summary
Version and release documentation alignment
package.json, CHANGELOG.md, docs/troubleshooting.md
Updates the package version, changelog release references, and authentication troubleshooting guidance for version 1.1.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely matches the main change: a 1.1.1 release with version bump and changelog cut.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release/v1.1.1

Comment @coderabbitai help to get the list of available commands.

1.1.0 was tagged but never published; npm users jump from 1.1.0-beta.1
straight to 1.1.1, so the troubleshooting note should name the version
they actually install.
The Security section listed three of the shipped fixes and skipped the
rest, including the password prompt echoing typed characters in
cleartext, the async-schema validation bypass, and the ReDoS hardening.
The release audit flagged the gap; wording follows the fix commit
(3cb1430). Also extends the output-layer escape-stripping entry to name
the surfaces it covers and records the brace-expansion resolution with
its consumer-install caveat.
@dennisdornon
dennisdornon merged commit 849c02f into main Jul 27, 2026
9 checks passed
@dennisdornon
dennisdornon deleted the release/v1.1.1 branch July 27, 2026 14:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant