@sriinnu/runic 2.13.4 → 2.13.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,10 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 2.13.5 — 2026-10-23
|
|
4
|
+
- Release integrity: the app is the same as 2.13.4; this release is the first through the hardened release path. The GitHub release is immutable once published (its tag and files can't be changed or swapped afterwards), and its tag is signed like every release tag.
|
|
5
|
+
- npm: `@sriinnu/runic` is published from GitHub Actions through npm trusted publishing, with a provenance attestation that ties the package to this tag. No publish token exists, and each version goes live only after the maintainer approves it with a hardware security key.
|
|
6
|
+
- Website: runic.srinivas.dev sends HSTS and Cross-Origin-Opener-Policy and builds from pinned dependencies.
|
|
7
|
+
|
|
3
8
|
## 2.13.4 — 2026-10-23
|
|
4
9
|
- Security: provider credentials stay on the endpoint they were meant for. Provider API, OAuth, browser-cookie and local-model requests no longer follow redirects, so a redirecting server can't carry your key or cookies to another host. A signed-out SiliconFlow or Ollama Cloud browser session is still recognized from the sign-in bounce and says so, and the MiniMax coding-plan page moved to `platform.minimax.io/console/plan`.
|
|
5
10
|
- Security: `runic otel-collect` listens on loopback only and prints a fresh bearer token at each start. OTLP exporters and `/events` clients must now send `Authorization: Bearer <token>`. Requests with a foreign Host or Origin, the wrong content type, or an oversized body are refused.
|