v1.4.4 release notes

Release Date: 2025-12-14 Type: Patch Release (Build Fixes & Security Hardening)

Overview

Version 1.4.4 resolves critical Docker Hub build failures that prevented v1.4.2 and v1.4.3 from building successfully in CI/CD, and addresses 12 security vulnerabilities in the web UI. This release also adds comprehensive GitHub Copilot instructions to improve AI-assisted development workflow.

Critical Build Fix

Docker Hub Webpack Compilation Failures

Root Cause: Corrupted package @natlibfi/loglevel-message-prefix@3.0.1 contains invalid import path

// CORRUPTED (lib/main.js line 39):
import polyfills from '@natlibfi(es6-polyfills';

// CORRECT:
import polyfills from '@natlibfi/es6-polyfills';

Impact: All 5 web workers failed to compile, causing complete build failures in Docker Hub CI/CD

Solution:

Automated Fix: New postinstall script uses sed to correct the import path
Memory Optimization: Added NODE_OPTIONS="--max-old-space-size=4096" for Docker Hub builds
Webpack Tuning: Reduced parallelism to 1, enhanced stats visibility
Plugin Resilience: Made BundleAnalyzerPlugin non-fatal

Result: Docker Hub builds now succeed reliably (98s compile time, 285MB image)

Security Fixes (12 Vulnerabilities)

All fixes are in web UI only - MCP server unaffected.

Critical: Code Injection (OutputWaiter.mjs)

Before: Unsafe code execution from user-controlled data After: Safe DOM script element creation Impact: Prevents arbitrary code execution

High: XSS Prevention Enhancements

Attribute Allowlist: Only safe attributes permitted

Allowed: id, class, value, data-* attributes
All other attributes removed

Value Validation: Comprehensive protocol injection prevention

Blocks javascript: protocol
Blocks data: URIs
Detects URL-encoded obfuscation (%6A%61%76%61%73%63%72%69%70%74:)
Case-insensitive matching

Protocol Validation: Enhanced with startsWith() for reliability

GitHub Copilot Instructions

Added comprehensive development guidance:

Files:

.github/copilot-instructions.md (204 lines)
.github/agents/copilot-instructions.md (discovery copy)

Contents:

Quick Start workflow
Architecture overview
Code conventions
Common development tasks
Troubleshooting guide
Security considerations

Benefits:

Improved AI assistant accuracy
Faster contributor onboarding
Consistent code style

Testing & Validation

# All tests passing
npm test
✓ 1,933 unit tests (1,716 operation + 217 Node API)

# Build verification
docker build -f Dockerfile.mcp -t cyberchef-mcp .
✓ Webpack 5.103.0 compiled in 98s
✓ All 5 worker compilations succeeded
✓ Image size: 285MB

# MCP server operational
npm run mcp
✓ All 465 tools functional

Upgrade Instructions

No breaking changes. Update via:

# Pull latest
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest

# Or rebuild
git pull origin master
git checkout v1.4.4
npm install
docker build -f Dockerfile.mcp -t cyberchef-mcp .

Files Changed

Build System:

Gruntfile.js - Added fixLoglevelMessagePrefix task
package.json - mcpVersion 1.4.3 → 1.4.4, postinstall script
webpack.config.js - Enhanced stats, reduced parallelism
Dockerfile - Memory optimization

Security:

src/web/waiters/OutputWaiter.mjs - Security hardening

Documentation:

.github/copilot-instructions.md - NEW
.github/agents/copilot-instructions.md - NEW
README.md - Version updated to v1.4.4
CHANGELOG.md - v1.4.4 section added

Docker Image

Registry: ghcr.io/doublegate/cyberchef-mcp_v1
Tags: v1.4.4, latest
Size: ~285MB compressed

# Pull
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:v1.4.4

# Offline install
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.4.4/cyberchef-mcp-v1.4.4-docker-image.tar.gz
docker load < cyberchef-mcp-v1.4.4-docker-image.tar.gz

Contributors

@doublegate - Build fix and optimization
@copilot-swe-agent - Security fixes (PR #10)
@copilot-swe-agent - Copilot instructions (PR #12)