Release gap: five security fixes and the --budget contract sit unreleased since 1.15.0 (2026-08-19)

[nikolay-e]

Observed

PyPI's latest diffctx is 1.15.0, uploaded 2026-08-19. Since then main
has 12 fix commits and 63 changelog bullets under [Unreleased], including
five findings in the ### Security section that reach a user of the shipped
wheel:

• MCP fetch passed a caller-supplied revision straight to git show, so
  diff_ref of the form HEAD..--output=<path> made a read-only tool write a
  file (fixed in 1db7c185).
• An explicit file argument or ** glob bypassed the secret-path floor —
  diffctx id_rsa printed what diffctx . withholds (1db7c185).
• An ignored directory's contents were readable through the MCP glob:
  withheld_paths dropped ancestor-inherited exclusions, so .venv/,
  dist/, target/ and any repository's secrets/ were servable
  (fd9dc14c).
• The scratch git dir for non-repository reads had a guessable name and
  git init adopts an existing .git, letting a pre-planted one decide what
  the reader treats as ignored (1db7c185).
• A .diffctx/ignore policy that could not be read failed open
  (1db7c185).

Plus the --budget contract fix (#241: the artifact was up to 3.15× the
requested cap) and the per-file budget monopoly (#238), both user-visible.

Why this is not fixed in this pass

Cutting a release dispatches cd.yml and publishes to PyPI, npm, crates.io
and Docker Hub. That is an owner decision, not a QA action, and this session
has a standing instruction never to dispatch one without an explicit yes.

Close condition

curl -s https://pypi.org/pypi/diffctx/json | jq -r .info.version returns a
version whose changelog section contains the entries above (i.e. the
[Unreleased] block has been cut into a release), and
gh release view --json tagName shows the matching tag with its artifacts.

Secondary, worth deciding in the same breath: the GitHub Action installs the
released wheel (diffctx-version default, currently 1.15.0), so the
dogfood review context on our own PRs — and every consumer of the Action —
runs the version with the holes above until this ships.