Headroom Daily: A Security Patch That Wasn't Done, and a Release Built to Prove It
Version 0.36.4 shipped five fixes, but the headline story is a security patch that only closed one of three real gaps in the upstream validation guard, plus a Codex regression that broke tool access mid-session. Both were caught, fixed, and backed with tests written to fail on the old code.
Duration: PT2M23S
Episode overview
This episode is a short developer briefing from Headroom Daily.
It explains recent repository work in plain language.
- Show: Headroom Daily
- Published: 2026-08-22T22:00:37Z
- Audio duration: PT2M23S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's August 22nd, and today's story is about how much trust to put in a fix that looks done.
The center of gravity today is pull request 3195, addressing the SSRF vulnerability tracked as CVE-2026-77775. The advisory said it was patched back in 0.36.1. It wasn't. When the upstream target resolver moved files, the security guard didn't follow, leaving the search endpoint able to forward caller credentials to…
The second theme is regressions from well-intentioned fixes. Commit 1617f83 found that lifting Codex's tool definitions to save tokens, shipped in 0.36.3, quietly broke multi-turn sessions — tools worked once, then vanished for the rest of the conversation, because the fix didn't account for how the client persists…
Rounding it out: dashboard assets were being served as plain text on some hosts, silently breaking the UI under security headers — fixed in pull request 3193. And commit 5d25abd cleaned up three flaky tests that were red on main, clearing the way for release 0.36.4 to ship clean.
What's next: watch pull requests 3202 and 3201, addressing leaked and stale proxy processes under wrap — same family of lifecycle bugs as today's fixes. And the DNS rebinding…
Tha…