AiSOC v20.0.0 — four published advisories, SSRF guard on every connector egress path, dependency queue at zero #1439

AiSOC v20.0.0 is out: release notes · full changelog.

This release is the close-out of a maintenance cycle that worked the queue to zero: every open pull request reviewed and merged or closed with its reason, every open issue resolved, the Dependabot queue emptied, and four vulnerability reports taken from reproduction to published advisory.

Four advisories, reproduced before fixed

Each report was reproduced against a production-mode stack before any patch was written, fixed, and published with credit to its reporter:

• GHSA-wwq7-2xvh-qgq6 (medium) — cases GET routes enforced no cases:read, so an API key minted with only alerts:read could list cases and read their comments, timeline and evidence chain. Reported by @antigravitysoham-eng.
• GHSA-9mc5-hqgh-j6wf (low) — any cases:write holder could author a comment the console renders as an unattributed "System note". Reported by @antigravitysoham-eng. Closing it is the release's one breaking change: the create route no longer accepts is_system (ignored, not refused — existing clients keep succeeding).
• GHSA-898c-wxrw-hx6c (high) — outbound webhooks: registration 500ed against row-level security for every tenant, and destinations were never SSRF-validated. Reported by @antigravitysoham-eng.
• GHSA-cq4g-g6wp-4m2w (high) — the connectors service never adopted the platform SSRF guard, so a tenant-controlled base_url could reach cloud metadata, loopback and internal services. Reported by @tal2k9dev-star.

The SSRF guard now sits on every connector egress path

The stateless test route, resource reads and scheduled polls all validate through the same guard the playbook engine uses; the API refuses the same destinations at connector create/update, before anything is encrypted and stored. The relax knobs are delivered to every service that runs the guard from one .env value: AISOC_SSRF_ALLOW_PRIVATE for on-prem systems on private ranges, AISOC_SSRF_ALLOW_HOSTS for exact named hosts. The cloud-metadata blocklist holds regardless of either. Documentation: operations/security.

Supply-chain pinning, in both directions

• The semgrep rule packs the scanner ratchet's ceiling was measured with are now vendored into the tree, with the ceiling bound to the packs' combined digest — a registry pack changing upstream can no longer silently re-grade the tree.
• The Oct-21 advisory wave is cleared across every lockfile: a critical certifi, aiohttp, pillow, the MCP SDK, and the npm floors. One recorded, expiring exception: services/threatintel genuinely embeds through fastembed, whose every release caps pillow below the fixed version, so its lock stays on 12.3.0 under nine suppressions with stated reasons (text-only embedding input, no PIL import) and a 2027-01-15 re-check date.
• The LLM gateway image is pinned to the exact version the stack was measured against, after upstream deleted the floating tag the compose file and Helm chart referenced.

Also in this release

• Four connectors (Lacework, Tines, Datadog, PagerDuty) stopped collapsing their vendor's own top severity into high; Datadog's emergency and alert levels map to critical too. All contributed by @meshreyy.
• An OpenCTI threat-intelligence feed client, validated against a live OpenCTI platform with the exact request/response pair pinned as fixtures. Contributed by @alexmateescu.
• The dependency train: fastapi 0.143.x repo-wide, express 5.3.0, go-chi 5.5.0, the thirty mergeable Dependabot bumps of 2026-10-13, and the workflow-action bumps. The Dependabot queue is at zero.

Defect count

23 distinct defects were addressed across this release and the one before it: 12 in v20.0.0 and 11 in v19.0.0, counting each distinct defect described under the Fixed and Security headings of those two CHANGELOG sections (dependency-advisory clears are listed above separately, not double-counted).

Upgraders: read the BREAKING section at the top of the v20.0.0 notes first. It is one request-schema change with a compatibility path.