diff --git a/CHANGELOG.md b/CHANGELOG.md index 49345c97..ae6498ee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,13 +13,15 @@ Status of the `main` branch. Changes prior to the next official version change w - Project activation errors are now reported to the client in Serena's system prompt, instead of failures being visible only in the log. This applies both to a failed activation of an explicitly given project and to a failed `--project-from-cwd` auto-detection (#1773). - - ProjectServer: Configure trusted hosts (local hosts only) when listening on localhost - - SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) - Enclose sub-prompts in XML-like tags to make scopes explicit - Prompts and prompt templates: - Allow initial project prompts and project-specific newly activated modes to use templating - Support function `embed_memory` in prompt templates to inline a memory's contents - - Security: Use sandboxed environment for prompt templating, preventing attackers from using custom prompts to + +* Security: + - ProjectServer: Configure trusted hosts (local hosts only) when listening on localhost + - SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) + - Use sandboxed environment for prompt templating, preventing attackers from using custom prompts to execute commands in an uncontrolled manner * CLI: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f607233c..8ddbff4e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -22,7 +22,7 @@ See the corresponding [memory](.serena/memories/adding_new_language_support_guid Before submitting a PR, be sure to document your relevant changes (i.e. new features, fixes) in `CHANGELOG.md`. Use a concise style and add your change to the appropriate section -("Language Servers", "Tools", "JetBrains", "CLI", "Memories", "Dashboard", "Hooks", "General"). +("Language Servers", "Tools", "JetBrains", "CLI", "Memories", "Dashboard", "Hooks", "General", "Security"). ## Python Environment Setup