-
fix(v1.9.1): quote IPv6 case pattern + bump README badges (V1+V2)
frostbyte_neo 发布于
2026-05-18 16:45:08 +00:00 Pre-push verifier on the v1.9.1 audit-closure delta returned FIX-AND-SHIP
with 2 MEDIUM findings. Both closed in this commit.V1 — IPv6 loopback bash glob pattern was broken:
http://[::1]:*in a case statement treats[::1]as a POSIX character
class (matching a single character that is:or1), not a literal
URL prefix. Legit IPv6 loopback URLs would have fallen through to the
"remote, require --allow-remote-ollama" branch — usability bug, not a
security regression (safe default still safe).Fix: quote the bracket-bearing pattern as
"http://[::1]:"*. Verified
all three localhost variants (127.0.0.1, localhost, [::1]) now match
LOCAL; non-localhost (203.0.113.5) still matches REMOTE.V2 — README static badges still at v1.9.0:
5 occurrences in README.md (release badge, Two-versions callout latest,
badge-pinning footnote, architecture-tree skill count, references
section). The v1.9.1 version bump in plugin.json + marketplace.json +
CHANGELOG.md didn't cascade to the static README badges that don't get
their data live from shields.io.Fix: bump all 5 to v1.9.1. This is precisely the class of bug the v1.9.0
audit GROW note proposed adding to agents/verifier.md as a 7th always-
check cut (cross-file string consistency). Catching it pre-push instead
of post-push confirms the proposed verifier upgrade has real value;
that upgrade is still tracked for v1.9.2.Verifier-deferred findings (V3 substring grep tightening, V4 TOCTOU
comment) ride into v1.9.2.Verification: bash -n + live case-pattern test for V1; rg "v1.9.0"
README.md returns empty for V2; make test green.下载附件