From 930bb07a4504ddac7b0ea4491c5d9886612bb28e Mon Sep 17 00:00:00 2001 From: hive-release-bot Date: Mon, 9 Nov 2026 13:32:22 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=96=20release:=20v5.209.4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.209.4 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot --- CHANGELOG.md | 6 ++++++ changelog.d/security-17386-maintainer-notes-mode.md | 1 - 2 files changed, 6 insertions(+), 1 deletion(-) delete mode 100644 changelog.d/security-17386-maintainer-notes-mode.md diff --git a/CHANGELOG.md b/CHANGELOG.md index fbefba396b..b7e9118d28 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,12 @@ Hive did not historically maintain a complete changelog. This file starts a prag ## Unreleased +## 2026-11-09 (v5.209.4) + +### Security + +- The maintainer-notes store (`/data/maintainer-notes.jsonl`, the private per-item notes the dashboard's Activity monitor shares between maintainers) is now created owner-only (0600) and an existing file left wider by an earlier release is tightened on its next write ([#17386](https://github.com/hivecommons/hive/issues/17386)). It was created 0644 under a world-traversable `/data`, so any agent UID on the spoke could read every note on every item — including deleted ones — rather than only the capped, per-item section a kick deliberately carries. + ## 2026-11-09 (v5.209.3) ### Changed diff --git a/changelog.d/security-17386-maintainer-notes-mode.md b/changelog.d/security-17386-maintainer-notes-mode.md deleted file mode 100644 index 1856ff0b90..0000000000 --- a/changelog.d/security-17386-maintainer-notes-mode.md +++ /dev/null @@ -1 +0,0 @@ -- The maintainer-notes store (`/data/maintainer-notes.jsonl`, the private per-item notes the dashboard's Activity monitor shares between maintainers) is now created owner-only (0600) and an existing file left wider by an earlier release is tightened on its next write ([#17386](https://github.com/hivecommons/hive/issues/17386)). It was created 0644 under a world-traversable `/data`, so any agent UID on the spoke could read every note on every item — including deleted ones — rather than only the capped, per-item section a kick deliberately carries.