Skip to main content
Fixed
- JSON:API and GraphQL serve a
:reference field's target under its
current slug and title, not the ones stored when the referrer was saved.
A :reference value stores %{"id", "type", "slug", "title"}, copied from
the target when the referrer is saved. Since 1.5 the fired artifact
carries the target's current label (#1998), but custom_fields on
JSON:API and GraphQL still served the copy, so renaming a target left
every API read of its referrers on the old name until each was saved
again. The read that already decides which targets the reader may see
(#2013) now also returns their slug and title, and every snapshot it keeps
carries those. No extra queries. The stored value and its shape are
unchanged, and so are editor, admin and system reads, which keep getting
the stored value whole because they can write it back.
(#2059)
- The release image builds again under OTP 29.1.1, whose
:httpc refused
GitHub's ~10.7 KB release-redirect headers. OTP 29.1.1 (inets 9.8)
defaults :httpc's max_header_size to 10240 bytes, settable only per
request, and tailwind, rustler_precompiled (y_ex) and elixir_make
(lazy_html, vix) all download their binaries through :httpc without the
option, so docker build failed with {:header_too_long, {:max, 10240}}.
The builder now rebuilds httpc from its installed beam with the default
set to nolimit (OTP 29.0's behaviour) before any download, and restores
the stock beam before mix release, so the image still ships unmodified
OTP. Only the build changes; a running instance is unaffected. CI's
setup steps apply the same patch.
(#2062, #2063)
Security
- req_llm 1.29.0 and plug_crypto 2.2.1 clear two Hex advisories.
req_llm 1.24.0's WebSocket streaming did not verify TLS certificates, so an
on-path attacker could read the API keys and OAuth tokens it sent
(EEF-CVE-2026-107685, GHSA-6vww-5m28-f26v, CRITICAL; fixed upstream in
agentjido/req_llm#1140). Kiln itself calls only
generate_text and
generate_object over HTTP, so its own code never took that path; a plugin
or host app streaming through req_llm did. plug_crypto 2.2.0 had
CVE-2026-105963 (MEDIUM). Only these two packages and what req_llm 1.29.0
requires (llm_db, zoi) moved. req_llm's own defaults changed between
1.24 and 1.29: redirects are off, transient HTTP statuses are retried with
backoff, and a release no longer loads a .env file, so keys must come
from real environment variables (as they already do in Kiln's image).
(#2057)
