Jamie 7e67ab75cc fix(feishu): escape regex metacharacters in stripBotMention ...

stripBotMention() passed mention.name and mention.key directly into
new RegExp() without escaping, allowing regex injection and ReDoS via
crafted Feishu mention metadata. extractMessageBody() in mention.ts
already escapes correctly — this applies the same pattern.

Ref: GHSA-c6hr-w26q-c636

2026-02-19 14:51:41 +01:00

..

bluebubbles

test(bluebubbles): merge typing start stop method checks

2026-02-19 10:09:34 +00:00

copilot-proxy

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

device-pair

Security: disable plugin runtime command execution primitive (#20828)

2026-02-19 10:17:29 +00:00

diagnostics-otel

fix(otel): complete diagnostics-otel OpenTelemetry v2 API migration (#12897)

2026-02-19 02:36:47 -08:00

discord

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

feishu

fix(feishu): escape regex metacharacters in stripBotMention

2026-02-19 14:51:41 +01:00

google-antigravity-auth

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

google-gemini-cli-auth

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

googlechat

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

imessage

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

irc

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

line

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

llm-task

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

lobster

lobster: parse windows cmd shim paths with rooted tokens (#20833)

2026-02-19 02:34:08 -08:00

matrix

fix(matrix): detect mentions in formatted_body matrix.to links (#16941)

2026-02-19 03:40:21 -08:00

mattermost

refactor(mattermost): dedupe reaction flow and test fixtures

2026-02-18 16:08:38 +00:00

memory-core

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

memory-lancedb

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

minimax-portal-auth

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

msteams

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

nextcloud-talk

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

nostr

fix: block ISATAP SSRF bypass via shared host/ip guard

2026-02-19 09:59:47 +01:00

open-prose

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

phone-control

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

qwen-portal-auth

TypeScript: add extensions to tsconfig and fix type errors (#12781)

2026-02-09 10:05:38 -08:00

shared

refactor(extensions): dedupe connector helper usage

2026-02-16 14:59:30 +00:00

signal

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

slack

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

talk-voice

Gateway/Plugins: device pairing + phone control plugins (#11755)

2026-02-08 18:07:13 +01:00

telegram

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

thread-ownership

test(extensions): cast fetch mocks to satisfy tsgo

2026-02-16 21:25:35 -05:00

tlon

fix: block ISATAP SSRF bypass via shared host/ip guard

2026-02-19 09:59:47 +01:00

twitch

perf(test): dedupe telegram allowlist and speed twitch probe

2026-02-18 04:16:36 +00:00

voice-call

test(voice-call): merge provider credential source cases

2026-02-19 09:55:43 +00:00

whatsapp

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00

zalo

test(security): add webhook hardening regressions

2026-02-19 13:31:28 +01:00

zalouser

chore: bump version to 2026.2.18 unreleased

2026-02-18 04:40:06 +01:00