Martin BallandClaude Opus 5.5 08da5c5433 #3699: MCP bridge sends the control key only to 127.0.0.1, where the app listens ...

Audit finding 9 (CWE-522). The bridge sent the reusable control key to any
loopback peer (127.0.0.0/8, ::1) and tried every address `localhost`
resolved to, while the app binds only 127.0.0.1. Another local user could
listen on ::1 or 127.0.0.2 and receive the key. Now `localhost` connects to
127.0.0.1 only, and the key goes only to a 127.0.0.1 peer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-23 20:19:49 +01:00

..

brand

#664: brand licence names WordCraft, not DesignCraft (#682)

2026-10-11 22:39:47 -04:00

images

M7/M14: comment balloons in the margin; ROADMAP alpha and parity estimates; README Review and Layout screenshots; cargo xtask alias

2026-10-06 01:38:55 -04:00

architecture.md

M15: Polish interface, and Polish spelling, grammar and hyphenation (#346)

2026-10-12 04:04:03 -04:00

contributors.md

About: contributor and model credits compiled in (grab bag + table, self-submitted names) (#6)

2026-10-07 21:17:02 -04:00

control-protocol.md

#3699: MCP bridge sends the control key only to 127.0.0.1, where the app listens

2026-10-23 20:19:49 +01:00

file-format-parity.md

CI: one test binary per crate, nextest, line tables only (#4025)

2026-10-23 14:24:37 -04:00

gaps.md

Selection bar: right margin for right-to-left text, and beside table rows (UI gap) (#2042)

2026-10-23 13:24:33 -04:00

hardware-parity.md

#2108: File › Print scales pages to another paper size (#2699)

2026-10-18 11:48:17 -04:00

layout-parity.md

Selection bar: right margin for right-to-left text, and beside table rows (UI gap) (#2042)

2026-10-23 13:24:33 -04:00

localization-hu.md

CI: one test binary per crate, nextest, line tables only (#4025)

2026-10-23 14:24:37 -04:00

localization-parity.md

CI: one test binary per crate, nextest, line tables only (#4025)

2026-10-23 14:24:37 -04:00

localization-sl.md

i18n(sl): add the 155 strings main gained since the catalog was drafted

2026-10-15 19:14:42 +02:00

localization-sv.md

CI: one test binary per crate, nextest, line tables only (#4025)

2026-10-23 14:24:37 -04:00

localization-tr.md

proof: Turkish spelling, suggestions, grammar and hyphenation (#1527)

2026-10-14 14:45:30 -04:00

mcp.md

#1963: wordcraft-cli runs commands from a script file (#2566)

2026-10-18 11:42:13 -04:00

parity-checklist.md

Mail merge: go to any record, and merge or print a range of records (#3028) (#3894)

2026-10-23 13:30:42 -04:00

recovery.md

CI: one test binary per crate, nextest, line tables only (#4025)

2026-10-23 14:24:37 -04:00

releasing.md

Bump version to 0.5.0; add Linux riscv64 release build (#394)

2026-10-10 19:41:30 -04:00

roadmap.md

CI: one test binary per crate, nextest, line tables only (#4025)

2026-10-23 14:24:37 -04:00

shared-pdf.md

PDFW: refresh shared writer on the audited snapshot

2026-10-13 13:11:47 -06:00

spelling-dictionaries.md

Proofing: say when a dictionary is installed but unreadable, with file and reason (#2830) (#2900)

2026-10-18 11:51:13 -04:00

target-app-parity.md

Merge PR #3056: Insert Table of Figures: a dialog with the caption label (Table, Equation, your own) (#3013)

2026-10-22 01:51:21 +00:00

typing-parity.md

IME: the caret follows the composition text (#3556)

2026-10-22 01:03:06 -04:00

ui-parity.md

Mail merge: go to any record, and merge or print a range of records (#3028) (#3894)

2026-10-23 13:30:42 -04:00

zotero.md

Zotero: a pending citation no longer edits a replacement document (#470) (#580)

2026-10-11 22:20:33 -04:00