[ralyodio]

v0.2.82 was tagged at #168 (music fix) five minutes before #169 merged, so secure-chat messaging and the hosting release race fix landed on master but in no release. Version bump only; secure-chat floor set to >=0.2.83.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

13 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 4

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	apps/web/public/sw.js:24
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:80
MEDIUM	sh-remote-script-execution	scripts/dev-setup.sh:25
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35
MEDIUM	sh-remote-script-execution	scripts/install.sh:173
MEDIUM	sh-remote-script-execution	scripts/install.sh:198
MEDIUM	sh-remote-script-execution	scripts/install.sh:316
MEDIUM	sh-remote-script-execution	scripts/install.sh:354
LOW	py-ssrf-outbound-request	examples/business-strategist-agent/chat.py:37
LOW	py-ssrf-outbound-request	examples/business-strategist-agent/train.py:54
LOW	secret-generic-credential	node/crates/c0mpute-core/src/webhook.rs:1165
LOW	py-path-traversal	node/crates/c0mpute-core/tests/fixtures/fake-infernet-text:29

Snippets are redacted; ThreatCrush never prints matched credential material.