$ the-wire · showcase
Promptfoo moves off vulnerable MSAL, PyRIT adds a char-split attack and cloud token detection
By RepoJournal · Filed · About AI Red Teaming · Composed from the cited sources · methodology
Promptfoo's optional Azure MSAL dependency now publishes as ^7.1.0, excluding the 7.0.x releases covered by the authorization-code origin advisory, while PyRIT extends CredentialLeakScorer to Azure SAS, SharedAccessKey and Databricks tokens and registers a new char_split attack technique.
fix(deps): update direct MSAL dependency to 7.1.0 promptfoo/promptfoo
The optional @azure/msal-node dependency moves from 7.0.1 to a ^7.1.0 range, so fresh npm installs no longer resolve to the 7.0.x versions named in the authorization-code origin advisory. The repo itself still locks Azure Identity 4.13.3 with a nested MSAL 6.0.1, so a checkout of Promptfoo's own source remains on the old copy.
FEAT: Detect Azure SAS, SharedAccessKey, and Databricks tokens in CredentialLeakScorer microsoft/PyRIT
CredentialLeakScorer gains three detection patterns in both _DEFAULT_PATTERNS and GARAK_PATTERNS: Azure SAS query strings with URL-encoded or raw base64 signatures, SharedAccessKey values in semicolon-delimited Azure connection strings, and Databricks tokens. Red team runs that previously scored those leaks as clean will now flag them without any scorer configuration on your side.
FEAT: Add char_split attack technique in extra.py microsoft/PyRIT
char_split is registered in pyrit/setup/initializers/techniques/extra.py, composing PromptTemplateConverter and SearchReplaceConverter on PromptSendingAttack, so you can select it as a technique in attack runs without hand-wiring converters.
fix(examples): support Google ADK telemetry v2 promptfoo/promptfoo
The Google ADK example now counts generate_content model calls instead of relying on a span that ADK 2.13's telemetry schema 2 no longer favors, keeping the span name valid on both 2.13 and the minimum supported ADK 2.9.2. The Python provider also respects the SDK's capture policy, and both quick starts show how to opt in to storing model messages and tool payloads via the example directory's ....
chore(deps): patch body-parser and fast-uri promptfoo/promptfoo
The lockfile picks up body-parser 2.4.0 for the API server and 1.20.9 for the docs dev server, closing a crash reachable with a compressed JSON request carrying trailing bytes, plus fast-uri 3.1.9 for Ajv's URI resolver; the qs override now starts at 6.16.1 to satisfy body-parser 2.4.0. Also shipped: PyRIT's LLMGenericTextConverter identifier now includes template parameters, and one CI change ...
Action items
- → Upgrade promptfoo and reinstall so @azure/msal-node resolves to ^7.1.0 rather than a 7.0.x release promptfoo/promptfoo [plan]
- → Upgrade promptfoo to a build with the patched lockfile if you run its API server from source promptfoo/promptfoo [plan]
