August 7, 2026

[cassidyjames]

Attendees: @EXBreder, @selena-lustig

Notes

• Performance benefits 20-30% due to execution changes
  • Right now only on Discord locally by Simon, TBD on ETA
• Follow up on in-progress features
  • Add pluggable LLM API provider hook with tool calling #337: Add pluggable LLM API provider hook with tool calling
  • Add rule authoring/editing UI backed by the rule-drafts API #403: Add rule authoring/editing UI backed by the rule-drafts API
• Dependabot Alerts Osprey has 46 open alerts, see if anyone is able to take a look at some of the high priority ones. It is worth noting that fixing some of these would require Discord to downgrade some of their versions so it can be tricky to assess
  • #59 (Werkzeug) - Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
  • #50 (Flask) - Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
  • #130 and #131 (Gunicorn) - Request smuggling leading to endpoint restriction bypass in Gunicorn
  • #212 (pyasn1 — plus its siblings Batch processing for historical analysis #208 and Remove transitive gevent imports from async worker #207) pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
  • #195 (Axios) - Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning