Pattern names containing ".." could be used to escape the patterns
directory and read arbitrary files via filepath.Join. Guard added at
the top of getFromDB; i18n key pattern_invalid_name added to all
11 locale files; test cases cover all common traversal variants.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove the unused `swag/jsonname` indirect module dependency.
- Prune stale checksums for superseded dependency versions.
- Retain checksums for currently resolved module versions.
- Refresh the fixture module checksum for version 0.27.3.
## CHANGES
- Add Claude Opus 5 to supported model selection
- Disable sampling parameters for Claude Opus 5 requests
- Restrict one-million-token beta headers to compatible Claude models
- Remove unsupported 200K-context models from beta header mapping
- Upgrade Anthropic, AWS, Ollama, Google, and supporting dependencies
- Use configured Anthropic max tokens as default
- Apply chat option max tokens when provided
- Preserve existing behavior for missing token overrides
- Add tests for default max token selection
- Add tests for explicit max token overrides
- Add `--closed-ok` flag to bypass open-state validation
- Skip mergeability checks when processing closed pull requests
- Store closed pull request allowance in generator configuration
- Guide users toward `--closed-ok` in validation errors
- Record incoming changelog entries for pull requests 2155 and 2156
- Refresh changelog database with new incoming metadata
- Add Claude Sonnet 5 to supported Anthropic models
- Omit sampling parameters for Claude Sonnet 5 requests
- Centralize Anthropic sampling restrictions behind prefix matching
- Enable one-million-token context beta for Claude 5 models
- Remove older Claude 4 aliases from model listings
- Update Anthropic tests for Sonnet 5 beta mapping
- Refresh Go dependencies across AI provider integrations
The extension executor runs commands via 'sh -c' with user-controlled
values interpolated into the command string without escaping. A value
containing shell metacharacters (;, |, $(), backticks) is executed by
the shell, enabling command injection.
User input flows from content processed through a pattern into the
extension system via the InputSentinel, then into formatCommand which
interpolates it into the cmd_template, then into exec.Command('sh', '-c').
No escaping is applied at any point.
Fix: wrap all user-controlled values (value, numbered pipe-split values)
in single quotes with embedded-single-quote escaping before interpolation.
This ensures sh -c treats them as literal arguments, not shell syntax.
The existing tests pass unchanged because the inner sh strips the single
quotes, so the executed command receives the same argument values.
Regression test added: ShellInjectionBlocked verifies that input
'hello; touch /marker' does not create the marker file.
Signed-off-by: John Kearney <johndanielkearney@gmail.com>
- Add persistent cache for provider model discovery results
- Serve stale model caches during discovery failures
- Return concise localized errors for rate-limited model fetches
- Send GitHub Models API version header automatically
- Add Claude Fable 5 Anthropic model support
- Omit sampling parameters for Claude Fable 5
- Update model rate-limit translations across supported locales
- Add tests for cache, rate-limit, and GitHub headers
- Update Go dependencies for AI provider integrations
- Add MiniMax-M3 to the static MiniMax model list as the new default
- Retain MiniMax-M2.7 and MiniMax-M2.7-highspeed as available alternatives
- Remove deprecated older models (M2.5 / M2.5-highspeed / M2.5-lightning / M2 / M2.1 / M2.1-lightning) from the static list
MiniMax-M3 is the new flagship model and becomes the default selection by being placed first in the static model list.
/Users/kayvan/src/fabric/internal/plugins/ai/codex/errors.go:61:5: errors.As can be simplified using AsType[*openaiapi.Error]
/Users/kayvan/src/fabric/internal/cli/flags.go:126:2: NumField/Field loop can simplified using Type.Fields iteration
/Users/kayvan/src/fabric/internal/cli/help.go:145:2: NumField/Field loop can simplified using Type.Fields iteration
/Users/kayvan/src/fabric/internal/cli/help.go:225:2: NumField/Field loop can simplified using Type.Fields iteration
/Users/kayvan/src/fabric/internal/i18n/i18n.go:222:15: strings.Split call can be simplified using strings.Cut
# CHANGES
- Upgrade Go toolchain to 1.26.0
- Bump anthropic-sdk-go to v1.46.0
- Add Claude Opus 4.8 to supported models
- Update AWS SDK and Bedrock service modules
- Bump ollama client to v0.24.0
- Refresh OpenTelemetry, gRPC, and genai dependencies
- Update go-git, sqlite3, and assorted indirect modules
