Event
pymaxim 1.3.2 fixes high-severity unauthenticated vulnerability
1 reports · 1 sources
dennys246/Maxim released pymaxim 1.3.2 (codename Decomposition), fixing high-severity security advisory GHSA-7qh4-mp34-88v9: previously the leader ran without authentication by default, and debug routes could be read via a cloudflared tunnel. 1.3.2 changes to fail-closed: a leader without an available key refuses to start (exit code 2), remote management is disabled by default, and the default role is solo. Upgrading requires running pip install --upgrade pymaxim locally on each leader and taking effect after a cold restart.
Report timeline
- dennys246/Maxim releases pymaxim 1.3.2 "Decomposition"
pymaxim 1.3.2 "Decomposition" is released, fixing high-severity security advisory GHSA-7qh4-mp34-88v9: previously a leader ran without authentication by default and debug routes could be read through a cloudflared tunnel; 1.3.2 changes to fail-closed by default, and each leader must run pip install --upgrade pymaxim on its own machine and cold restart.
GitHub Embodied AI Topic ·