3.4.0 (2026-08-20)
Features
- cli: add global --allow-symlinks option for shared symlinked folders/files (78d7104)
- commands: surface security warnings for skipped files and enforce strict deletion boundaries (f2d835d)
- implement PKCE support in OAuth flows (#1142) (1a1665e)
Bug Fixes
- auth: remove hardcoded OAuth client secret from published npm package (CWE-798) (#1139) (a678e92)
- auth: restore OAuth client secret for desktop public client compatibility (be27aaf)
- auth: secure credential file writing with symlink protection and permissions (378c1a6)
- core: secure file system crawling, atomic writes, and structured security reporting (aa4cfeb)
- create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), refs #1154
- deps: update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues (87a3759)
- mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)
- prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)
- Print help instead of throwing error on unknown commands (#1157) (39a9c12)
- security: clean up CSRF demo script and harden path boundary & test mocks (0a28a48)
- security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)
- security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)