From de92a2f803293856635bd58da1f172e784e6b26c Mon Sep 17 00:00:00 2001 From: Binay Date: Tue, 18 Aug 2026 20:10:39 -0400 Subject: [PATCH] chore: bump the signetry-core pin to v0.7.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.7.0 shipped Kotlin detection, Go SSRF, Go/Java path traversal, PHP XXE, the Aider executor and the SSRF precision fixes. These references still installed v0.6.0, so anything following them got an engine several rules behind. CHANGELOG entries are deliberately left at v0.6.0 — they record what a past release pinned and are not live install instructions. --- SECURITY.md | 2 +- integrations/git-hooks/pre-push | 2 +- integrations/github-action/action.yml | 2 +- signetry_core/mcp_server.py | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0ee0ced..1f7f7e7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -20,7 +20,7 @@ dev-key verification trust, and — in the companion GitHub Action `< v0.1.3` workflow script-injection sink). `0.5.1+` adds bring-your-own-key credential redaction for `--fix`. Pin the Action to `@v1` (which moves forward) or `@v0.1.3+`, and install `signetry-core` from source at `@v0.5.3` or later -(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"`). +(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`). ## Reporting a vulnerability diff --git a/integrations/git-hooks/pre-push b/integrations/git-hooks/pre-push index 8a07b2e..4eb9256 100755 --- a/integrations/git-hooks/pre-push +++ b/integrations/git-hooks/pre-push @@ -20,7 +20,7 @@ if [[ "${SIGNETRY_SKIP:-0}" == "1" ]]; then fi if ! command -v signetry >/dev/null 2>&1; then - echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.6.0\"'." >&2 + echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.7.0\"'." >&2 echo "signetry: skipping the governance gate (not installed)." >&2 exit 0 fi diff --git a/integrations/github-action/action.yml b/integrations/github-action/action.yml index 67b55c1..80d07b1 100644 --- a/integrations/github-action/action.yml +++ b/integrations/github-action/action.yml @@ -46,7 +46,7 @@ runs: - name: Install signetry-core shell: bash # source-available (All Rights Reserved); not on PyPI — install from source. - run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0" + run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" - name: Stage the PR change as a working-tree diff id: stage diff --git a/signetry_core/mcp_server.py b/signetry_core/mcp_server.py index 030a167..86fb652 100644 --- a/signetry_core/mcp_server.py +++ b/signetry_core/mcp_server.py @@ -7,7 +7,7 @@ receipt; the verdict is produced outside the model. Run it: - pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.6.0" + pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0" python -m signetry_core.mcp_server # stdio transport Register it with an MCP client (e.g. Claude Code) pointing at this command. @@ -106,7 +106,7 @@ def build_server(): # pragma: no cover - exercised only when mcp is installed except ImportError as exc: # noqa: F841 raise SystemExit( "The MCP server needs the optional dependency: pip install " - "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.6.0'" + "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0'" ) from None mcp = FastMCP("signetry-core")