Skip to content
Catalyst Catalyst Catalyst

Catalyst Dev — Change Log
All versions All versions forward

Version 12.42.0

Aug 02, 2026

Worktree Guard & DNS Rebinding Fix

The monitor’s reply endpoint now validates Origin against a trusted allowlist of loopback addresses, local hostnames, and non-loopback IPs — closing a DNS rebinding hole where an attacker-controlled page could post Linear comments as the operator. Separately, every shell-side git worktree remove --force call now runs a safety check that refuses removal if your current directory is inside the target or any process holds an open handle under it, protecting against accidental self-deletion that the Node reaper never covered.

PRs

  • dev: CTL-1417 — worktree-removal self-protection guard (#2556) (24b9a76)
  • dev: CTL-1573 validate reply Origin against a trusted allowlist, not the request Host (#2857) (10ecce7)