release: v6.7.1 — DNS-rebinding fix for ops dashboard#256
Merged
Conversation
Patches a DNS-rebinding vulnerability in the local ops dashboard that allowed any visited website to invoke ops endpoints (including workflow execution) on the local machine. Fix landed in #254. Also bundles UI/UX changes shipped between v6.7.0 and now: Tier 1 rich rendering (#247), full-page run view (#251), specs tab (#236/#239/#240), humanized 409s + tab cleanup (#228/#231), run-enabled-by-default ops mode (#227). Bumps version in pyproject.toml, plugin manifests, root marketplace.json, .claude/CLAUDE.md, API_REFERENCE.md, and uv.lock. CHANGELOG entry leads on the security fix.
github-actions
Bot
added
documentation
🔒 Security Scan Results✅ Status: PASSED - No blocking issues Summary
Total Findings: 0 🛠️ Need Help?If findings are false positives:
For emergency hotfixes:
Scanner Accuracy: ~82% (Industry-leading!) Powered by Attune AI Security Scanner | Documentation |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
4 tasks
silversurfer562
added a commit
that referenced
this pull request
May 12, 2026
… spec (#280) Phases 1-4 of docs/specs/ops-security-hardening/ all landed across v6.7.1 PRs (#254 + #256) earlier today. This adds the one missing piece — Phase 2.3 regression guard — and closes the spec docs. CODE - tests/unit/ops/test_runner.py: add test_subscriber_queue_does_not_block_fast_subscribers. Regression guard asserting that a slow subscriber doesn't block fast ones — _broadcast is a synchronous per-subscriber put_nowait, so QueueFull on one subscriber must not affect others. Pairs with the existing test_subscriber_queue_drops_slow_subscriber. SPEC - All 4 spec files: status draft -> complete (2026-05-12, pending Phase 5 smoke). Phase 5 = Patrick's manual curl + browser checks; not automatable from a session. - decisions.md: closure entry with the 3-PR table, satisfied resolution criteria, and the "out-of-scope items remain deferred, not regressions" note. - tasks.md: Phase 1-4 boxes ticked. Phase 5-6 remain open (10 items) pending manual verification. Local: tests/unit/ops/ 142 passed in 2.69s (was 141; +1 new test). Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patch release for the ops dashboard DNS-rebinding vulnerability fixed in #254, plus the UX changes that shipped between v6.7.0 and now.
Users running
attune opsshould upgrade. v6.7.1 fixes a DNS-rebinding vulnerability that allowed any visited website to invoke ops dashboard endpoints (including endpoints that trigger workflow execution) on the local machine. Pre-existing since the ops runner first shipped — not introduced by recent changes.Version bumps
pyproject.toml,uv.lockplugin/.claude-plugin/{plugin,marketplace}.jsonplugin/core/__init__.py.claude-plugin/marketplace.json(root).claude/CLAUDE.md(header + footer)docs/reference/API_REFERENCE.md(header + footer)test_all_versions_matchconfirms parity.Changelog (highlights)
Hostheader against loopback set.attune opsruns run-enabled by default;--read-onlyopts out (feat(ops): default to run-enabled, add --read-only opt-out #227).Test plan
pytest tests/unit/plugins/test_plugin_config_validation.py::TestVersionConsistencypasses locallyv6.7.1on the merge commit after squashpublish-pypi.ymlapproved and v6.7.1 live on PyPI🤖 Generated with Claude Code