proffesor-for-testing__agentic-qe/docs/releases/v3.7.6.md

v3.7.6 Release Notes

Release Date: 2026-03-02

Highlights

Wire 30 previously unreachable MCP tools, resolve all 9 GitHub code scanning alerts, and clean up dead dependencies and unused code.

Security

• Resolve all 9 GitHub code scanning alerts (5 HIGH, 4 MEDIUM):
  • Fix DOM XSS in sorter.js — replace innerHTML with createElement/appendChild
  • Fix weak password hash in test fixture — SHA-512 → scryptSync
  • Fix incomplete URL sanitization in OAuth test — .includes() → exact match
  • Fix incomplete hostname regexp — escape regex special chars
  • Fix prototype pollution flags — direct assignment on null-prototype objects
  • Delete obsolete publish-v3-alpha.yml workflow

Added

• 26 QE tools wired via new qe-tool-bridge.ts — GOAP planning, embeddings, coherence, mincut routing, learning stats, coverage gaps, QX partner, and more now accessible through MCP
• 4 new MCP tools with full CLI support:
  • qe/tests/schedule — Phase-based test pipeline with git-aware selection
  • qe/tests/load — Agent fleet load testing with mock/real mode
  • qe/security/url-validate — URL threat detection + PII exposure scanning
  • qe/workflows/browser-load — YAML workflow loading and validation
• Fleet health enriched with structural metrics (mincut-lambda from real agent connectivity)

Changed

• Remove 7 dead devDependencies: rimraf, tinybench, ts-node, typedoc, stack-utils, graceful-fs, eslint-plugin-security
• Move @faker-js/faker from devDependencies to dependencies (used at runtime in test-generation domain)
• Archive neural-optimizer module to src/_archived/ (restorable when 100+ agent fleets need it)
• Delete 935-line unused qe-tools.ts and 9 Istanbul static assets from src/coverage/